@code-partner/codepipe-hub 0.14.1-dev.420.g57ff103d → 0.14.1-dev.423.ga49d1f61

package/hub/dist/index.js

@@ -13,7 +13,7 @@ var PLATFORM_VERSION;
 var init_version_generated = __esm({
   "../packages/shared/dist/version.generated.js"() {
     "use strict";
-    PLATFORM_VERSION = "0.14.1-dev.420.g57ff103d";
+    PLATFORM_VERSION = "0.14.1-dev.423.ga49d1f61";
   }
 });
 
@@ -31,8 +31,8 @@ var init_version = __esm({
   "../packages/shared/dist/version.js"() {
     "use strict";
     init_version_generated();
-    PROTOCOL_VERSION = 4;
-    MIN_SUPPORTED_PROTOCOL = 4;
+    PROTOCOL_VERSION = 5;
+    MIN_SUPPORTED_PROTOCOL = 5;
   }
 });
 
@@ -2960,21 +2960,14 @@ var init_duration = __esm({
 });
 
 // ../packages/shared/dist/node-handshake.js
-function readNodeSocketSecrets(headers, query) {
-  const found = [];
+function readNodeSocketSecret(headers) {
   const raw = headers["authorization"];
   const header = Array.isArray(raw) ? raw[0] : raw;
-  if (typeof header === "string") {
-    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-    const token = match?.[1]?.trim();
-    if (token !== void 0 && token !== "")
-      found.push({ token, source: "header" });
-  }
-  const fromQuery = query?.token;
-  if (typeof fromQuery === "string" && fromQuery !== "") {
-    found.push({ token: fromQuery, source: "query" });
-  }
-  return found;
+  if (typeof header !== "string")
+    return null;
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  const token = match?.[1]?.trim();
+  return token !== void 0 && token !== "" ? token : null;
 }
 function decideNodeHandshake(frame, hub, recognizedCapabilities, authenticatedAs) {
   const handshake = parseNodeHandshake(frame);
@@ -8716,7 +8709,12 @@ var init_route_definition = __esm({
       "bootstrap.request",
       "bootstrap.confirm",
       "bootstrap.authorizeEmail",
-      "bootstrap.authorizeConfirm"
+      "bootstrap.authorizeConfirm",
+      // DEV-927: a node registers with a registration token in the body — the
+      // token IS the credential, and there is no node identity yet to bear it.
+      "node.sandbox.register",
+      "node.farm.register",
+      "node.runner.register"
     ];
   }
 });
@@ -10580,6 +10578,15 @@ function humanSubjectOf(actor) {
     return actor.principal.delegatedBy ?? null;
   return null;
 }
+function accountOf(actor) {
+  const subjectId = humanSubjectOf(actor);
+  if (subjectId === null)
+    return null;
+  return {
+    subjectId,
+    email: actor.principal.kind === "human" && actor.displayEmail !== void 0 ? actor.displayEmail : null
+  };
+}
 function serviceOf(actor) {
   return actor.principal.kind === "service" ? actor.principal.service : null;
 }
@@ -11488,16 +11495,40 @@ function createReadOperations(port, authorizer) {
     return { projectId, items: rows, revision: valueRevision(rows) };
   }
   function projectVisibilityOf(actor) {
-    const subjectId = humanSubjectOf(actor);
-    if (subjectId === null)
+    const account = accountOf(actor);
+    if (account === null)
       return null;
     return {
-      subjectId,
-      ...actor.principal.kind === "human" && actor.displayEmail !== void 0 ? { email: actor.displayEmail } : {},
+      subjectId: account.subjectId,
+      ...account.email === null ? {} : { email: account.email },
       ...actor.projectScope === void 0 ? {} : { projectScope: actor.projectScope },
       includeUnowned: actor.authMethod !== "cli_token"
     };
   }
+  function farmsView(rows) {
+    return {
+      items: rows.map((r) => ({
+        id: r.farmId,
+        name: r.name,
+        publicKey: r.publicKey,
+        keyFingerprint: r.keyFingerprint,
+        online: r.online,
+        lastSeenAt: toOptionalTimestamp(r.lastSeenAt)
+      }))
+    };
+  }
+  function projectDeliverablesView(projectId, rows) {
+    return {
+      projectId,
+      items: rows.map((r) => ({
+        taskKey: r.taskKey,
+        title: r.title,
+        phase: r.phase,
+        updatedAt: toTimestamp(r.updatedAt),
+        repos: r.repos.map((x) => ({ repoName: x.repoName, branchName: x.branchName, baseRef: x.baseRef }))
+      }))
+    };
+  }
   async function visibleProjects(actor) {
     const visibility = projectVisibilityOf(actor);
     return visibility === null ? [] : await port.visibleProjectIds(visibility);
@@ -11966,6 +11997,15 @@ function createReadOperations(port, authorizer) {
       const rows = await port.listRepos(query.projectId);
       return reposView(query.projectId, rows);
     },
+    async listProjectDeliverables(actor, query) {
+      await require2(actor, "delivery.read", { type: "deliverable", projectId: query.projectId });
+      return projectDeliverablesView(query.projectId, await port.listProjectDeliverables(query.projectId));
+    },
+    async listFarms(actor) {
+      await require2(actor, "account.read", { type: "account" });
+      const account = accountOf(actor);
+      return farmsView(account === null ? [] : await port.listFarms(account));
+    },
     async listConfigProposals(actor, query) {
       await require2(actor, "project.read", { type: "project", id: query.projectId, projectId: query.projectId });
       const limit = normalizeLimit(query.limit);
@@ -12195,8 +12235,18 @@ function createCommandOperations(deps) {
         });
       case "unprocessable":
         throw errors.unprocessable({ details: { reason: outcome.reason } });
+      case "not_found":
+        throw errors.notFound();
+      case "rate_limited":
+        throw errors.rateLimited();
     }
   }
+  function accountActorOf(actor) {
+    const account = accountOf(actor);
+    if (account === null)
+      throw errors.forbidden({ details: { reason: "human_only" } });
+    return account;
+  }
   async function audited(actor, entry, run) {
     const policy = { decision: "not_evaluated" };
     const common = {
@@ -12685,6 +12735,115 @@ function createCommandOperations(deps) {
         return { value: outcome.result, replayed: outcome.replayed };
       });
     },
+    async createProject(actor, command) {
+      const { project } = command;
+      const projectId = project.projectId;
+      if (!PROJECT_ID_RE.test(projectId)) {
+        throw errors.invalidInput({
+          message: "A project id is lowercase letters, digits and dashes, starts with a letter, 2\u201331 characters.",
+          details: { field: "projectId" }
+        });
+      }
+      for (const repo of project.repos) {
+        if (repo.defaultBranch !== void 0 && !isValidBranchName(repo.defaultBranch)) {
+          throw errors.invalidInput({ message: "That is not a valid git branch name.", details: { field: "repos.defaultBranch", repo: repo.name } });
+        }
+      }
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "project.create", projectId, key };
+      return await audited(actor, { operationId: "project.create", aggregateType: "project", aggregateId: projectId, projectId, data: { name: project.name, tracker: project.trackerProvider } }, async (policy) => {
+        await require2(actor, "account.manage", { type: "account" }, policy);
+        const run = await runIdempotent(idempotency, scope, { project }, async () => unwrap(await write2.createProject({ project, owner: accountActorOf(actor) })), now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async provisionOnFarm(actor, command) {
+      const { farmId, projectId } = command;
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "farm.provision", projectId, key };
+      return await audited(actor, { operationId: "farm.provision", aggregateType: "project", aggregateId: projectId, projectId, data: { farmId } }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const run = await runIdempotent(idempotency, scope, { farmId, projectId }, async () => {
+          const row = unwrap(await write2.provisionOnFarm({ farmId, projectId, sealedBundle: command.sealedBundle, actor: accountActorOf(actor) }));
+          return { projectId, farmId, ok: row.ok, daemonStatus: row.daemonStatus, error: row.error };
+        }, now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async provisionGhRunners(actor, command) {
+      const { runnerId, projectId } = command;
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "runner.provisionGhRunners", projectId, key };
+      return await audited(actor, { operationId: "runner.provisionGhRunners", aggregateType: "project", aggregateId: projectId, projectId, data: { runnerId } }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const run = await runIdempotent(idempotency, scope, { runnerId, projectId }, async () => {
+          const row = unwrap(await write2.provisionGhRunners({ runnerId, projectId, sealedBundle: command.sealedBundle, actor: accountActorOf(actor) }));
+          return {
+            projectId,
+            runnerId,
+            ok: row.ok,
+            runners: row.runners.map((r) => ({ owner: r.owner, repo: r.repo, status: r.status, error: r.error, labels: r.labels })),
+            error: row.error
+          };
+        }, now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async teardownGhRunners(actor, command) {
+      const { runnerId, projectId } = command;
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "runner.teardownGhRunners", projectId, key };
+      const repo = command.repo ?? null;
+      return await audited(actor, {
+        operationId: "runner.teardownGhRunners",
+        aggregateType: "project",
+        aggregateId: projectId,
+        projectId,
+        data: { runnerId, ...repo === null ? {} : { repo: `${repo.owner}/${repo.repo}` } }
+      }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const run = await runIdempotent(idempotency, scope, { runnerId, projectId, repo }, async () => {
+          const row = unwrap(await write2.teardownGhRunners({
+            runnerId,
+            projectId,
+            sealedBundle: command.sealedBundle ?? null,
+            repo,
+            actor: accountActorOf(actor)
+          }));
+          return { projectId, runnerId, ok: row.ok, error: row.error };
+        }, now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async requestProjectIndex(actor, command) {
+      const { projectId, kind } = command;
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "project.index", projectId, key };
+      return await audited(actor, { operationId: "project.index", aggregateType: "project", aggregateId: projectId, projectId, data: { kind } }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const run = await runIdempotent(idempotency, scope, { kind }, async () => {
+          const { jobId } = unwrap(await write2.enqueueProjectIndex({ projectId, kind }));
+          return { jobId, kind };
+        }, now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async issueWorkerRegistrationToken(actor) {
+      const subjectId = actor.principal.subjectId;
+      return await audited(actor, { operationId: "worker.issueRegistrationToken", aggregateType: "account", aggregateId: subjectId, projectId: null }, async (policy) => {
+        await require2(actor, "account.manage", { type: "account" }, policy);
+        const issued = unwrap(await write2.issueWorkerRegistrationToken({ owner: accountActorOf(actor) }));
+        return { value: { secret: issued.secret, expiresAt: toTimestamp(issued.expiresAt) }, replayed: false };
+      });
+    },
+    async reportInitStatus(actor, command) {
+      const { projectId, phase } = command;
+      return await audited(actor, { operationId: "project.reportInitStatus", aggregateType: "project", aggregateId: projectId, projectId, data: { phase, failed: command.error !== void 0 } }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const { recorded } = unwrap(await write2.reportInitStatus({ projectId, phase, error: command.error ?? null }));
+        return { value: { recorded }, replayed: false };
+      });
+    },
     async setRepoDefaultBranch(actor, command) {
       const { projectId, name } = command;
       const revision = asRevision(command.revision);
@@ -12974,8 +13133,8 @@ var init_cutover_preflight = __esm({
     SECRET_CONSUMERS = [
       { consumer: "agent credential in the job bundle (Claude / Codex)", purpose: "agent_execution", implemented: true, note: "issued per job from the project's auth mode" },
       { consumer: "repository clone tokens in the job bundle (GitHub / GitLab / Bitbucket)", purpose: "repository_read", implemented: true, note: "one grant for each host the job clones" },
-      { consumer: "Context Repo push of the delivery from the SANDBOX (contextWrite)", purpose: "context_write", implemented: false, note: "open: the delivery has to reach the holder of the materializer role without a write credential on the SANDBOX \u2014 the transport is an owner's decision" },
-      { consumer: "mirror clone token in the job bundle (mirrorWrite, read use)", purpose: "repository_read", implemented: false, note: "open: a read grant under the mirror's host, issued with the delivery transport" },
+      { consumer: "Context Repo push of the delivery from the SANDBOX (contextWrite)", purpose: "context_write", implemented: true, note: "the SANDBOX publishes the delivery over the host-local relay and the holder of the materializer role pushes it; no write credential on the SANDBOX" },
+      { consumer: "mirror clone token in the job bundle (mirrorWrite, read use)", purpose: "repository_read", implemented: true, note: "a read grant under the mirror's host, issued by the holder of the role with the other repository grants" },
       { consumer: "tracker writes (YouTrack) \u2014 CLI-side, never on the SANDBOX", purpose: "tracker_write", implemented: true, note: "nothing to move: the holder of the role already writes" },
       { consumer: "named project secrets in custom-action runs \u2014 CLI-side", purpose: "custom_action", implemented: true, note: "nothing to move until a tool-run executes on the SANDBOX" }
     ];
@@ -25654,10 +25813,16 @@ async function deleteSandboxRegistration(db, sandboxId) {
 async function sandboxRoutes(app, deps) {
   const { db, config } = deps;
   const registerByIp = createAbuseThrottle({ windowMs: 15 * 6e4, max: 30 });
-  const regTokenMintByEmail = createAbuseThrottle({ windowMs: 60 * 6e4, max: 30 });
   app.post(
-    "/sandbox/register",
+    "/node/v1/sandbox/register",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.sandbox.register",
+        authPolicy: "public",
+        stability: "preview",
+        summary: "Register a SANDBOX with a registration token"
+      }),
       schema: {
         body: {
           type: "object",
@@ -25698,14 +25863,29 @@ async function sandboxRoutes(app, deps) {
       return { sandboxId: id, token };
     }
   );
-  app.get("/sandbox/me", async (req, reply) => {
+  app.get("/node/v1/sandbox/me", routeMeta({
+    surface: "node",
+    operationId: "node.sandbox.me",
+    authPolicy: "node_actor",
+    resourcePolicy: "node.connect",
+    stability: "preview",
+    summary: "Is this SANDBOX registration still known"
+  }), async (req, reply) => {
     const sandbox = await authenticateSandboxByBearer(db, req.headers.authorization);
     if (!sandbox) return reply.status(401).send({ error: "unauthorized" });
     return { sandboxId: sandbox.id, name: sandbox.name };
   });
   app.post(
-    "/sandbox/agent-auth",
+    "/node/v1/sandbox/agent-auth",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.sandbox.agentAuth",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Report the host's agent login and ask whether to probe it"
+      }),
       schema: {
         body: {
           type: "object",
@@ -25741,8 +25921,16 @@ async function sandboxRoutes(app, deps) {
     }
   );
   app.post(
-    "/sandbox/agent-auth/result",
+    "/node/v1/sandbox/agent-auth/result",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.sandbox.agentAuthResult",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Report the verdict of an agent login probe"
+      }),
       schema: {
         body: {
           type: "object",
@@ -25792,19 +25980,6 @@ async function sandboxRoutes(app, deps) {
     app.log.info({ email: session.email, revoked }, "sandbox reg token revoked");
     return { revoked };
   });
-  app.post("/sandbox/reg-token/cli", async (req, reply) => {
-    const auth = await resolveCliAuth(db, config, req.headers.authorization);
-    if (!auth) {
-      return reply.status(401).send({ error: "bad_cli_token" });
-    }
-    if (!regTokenMintByEmail.take(`email:${auth.email}`)) {
-      app.log.warn({ email: auth.email }, "ephemeral sandbox reg token mint throttled");
-      return reply.status(429).send({ error: "too_many_requests" });
-    }
-    const { secret, expiresAt } = await issueEphemeralSandboxRegToken(db, auth.email);
-    app.log.info({ email: auth.email }, "ephemeral sandbox reg token issued for CLI");
-    return { secret, expiresAt };
-  });
   app.delete(
     "/sandbox/:sandboxId",
     async (req, reply) => {
@@ -25841,163 +26016,16 @@ var init_sandbox2 = __esm({
     init_sealedbox();
     init_abuse_throttle();
     init_auth();
-    init_cli_auth();
     init_sandbox_reg_tokens();
     init_users();
     init_agent_auth_probe();
     init_ws();
-  }
-});
-
-// src/farm/pool-spec.ts
-var pool_spec_exports = {};
-__export(pool_spec_exports, {
-  buildSyncWorkerPoolMessage: () => buildSyncWorkerPoolMessage,
-  computeFarmPoolSpec: () => computeFarmPoolSpec,
-  reconcileFarmPools: () => reconcileFarmPools
-});
-import { nanoid as nanoid25 } from "nanoid";
-async function computeFarmPoolSpec(db, farmId) {
-  const rows = await db.all(
-    `SELECT fa.user_id as userId, fa.max_sandboxes as quota,
-            p.id as projectId
-       FROM farm_assignments fa
-       JOIN projects p ON p.farm_id = fa.farm_id AND p.owner_user_id = fa.user_id
-      WHERE fa.farm_id = ?
-      ORDER BY fa.assigned_at ASC, p.id ASC`,
-    farmId
-  );
-  const ceilingRow = await db.get(
-    `SELECT max_sandboxes as ceiling FROM farms WHERE id = ?`,
-    farmId
-  );
-  const ceiling = ceilingRow ? Number(ceilingRow.ceiling) : 16;
-  const byAccount = /* @__PURE__ */ new Map();
-  for (const r of rows) {
-    const acc = byAccount.get(r.userId) ?? { quota: Number(r.quota), projectIds: [] };
-    acc.projectIds.push(r.projectId);
-    byAccount.set(r.userId, acc);
-  }
-  const spec = [];
-  let remaining = ceiling;
-  for (const [userId, acc] of byAccount) {
-    const quota = Math.max(0, Math.min(acc.quota, remaining));
-    remaining -= quota;
-    spec.push({ userId, projectIds: acc.projectIds, quota });
-  }
-  return spec;
-}
-function buildSyncWorkerPoolMessage(accounts) {
-  return { type: "sync_worker_pool", requestId: nanoid25(16), accounts };
-}
-async function reconcileFarmPools(db, send, log) {
-  const farms = await db.all(`SELECT id FROM farms`);
-  const live = new Set(farms.map((f) => f.id));
-  for (const id of [...starvationReported]) {
-    if (!live.has(id)) starvationReported.delete(id);
-  }
-  const starved = [];
-  let pushed = 0;
-  for (const farm of farms) {
-    const accounts = await computeFarmPoolSpec(db, farm.id);
-    if (accounts.length > 0) {
-      const sent = send(farm.id, buildSyncWorkerPoolMessage(accounts));
-      if (sent !== false) pushed++;
-      starvationReported.delete(farm.id);
-      continue;
-    }
-    const queued = await db.get(
-      `SELECT COUNT(*) AS n FROM jobs j
-         JOIN projects p ON p.id = j.project_id
-        WHERE j.state = 'queued' AND p.farm_id = ?`,
-      farm.id
-    );
-    if (Number(queued.n) === 0) {
-      starvationReported.delete(farm.id);
-      continue;
-    }
-    starved.push(farm.id);
-    if (!starvationReported.has(farm.id)) {
-      starvationReported.add(farm.id);
-      log.warn(
-        { farmId: farm.id, queued: Number(queued.n) },
-        "farm has NO worker-pool accounts while jobs are queued \u2014 assignments missing?"
-      );
-    }
-  }
-  return { farms: farms.length, pushed, starved };
-}
-var starvationReported;
-var init_pool_spec = __esm({
-  "src/farm/pool-spec.ts"() {
-    "use strict";
-    starvationReported = /* @__PURE__ */ new Set();
-  }
-});
-
-// src/farm/provision.ts
-import { nanoid as nanoid26 } from "nanoid";
-function handleFarmResult(msg) {
-  const type = msg["type"];
-  if (typeof type !== "string" || !RESULT_TYPES.has(type)) return;
-  const requestId = typeof msg["requestId"] === "string" ? msg["requestId"] : "";
-  const p = pending2.get(requestId);
-  if (!p) return;
-  clearTimeout(p.timer);
-  pending2.delete(requestId);
-  p.resolve(msg);
-}
-function awaitResult(requestId, send, timeoutMs) {
-  if (!send()) return Promise.reject(new Error("farm_offline"));
-  return new Promise((resolve4, reject) => {
-    const timer = setTimeout(() => {
-      pending2.delete(requestId);
-      reject(new Error("farm_timeout"));
-    }, timeoutMs);
-    pending2.set(requestId, { resolve: resolve4, reject, timer });
-  });
-}
-function requestProvision(farmId, projectId, sealedBundle, timeoutMs) {
-  const requestId = nanoid26(16);
-  return awaitResult(
-    requestId,
-    () => sendToFarm(farmId, { type: "provision_project", requestId, projectId, sealedBundle }),
-    timeoutMs
-  );
-}
-function requestDelete(farmId, projectId, timeoutMs) {
-  const requestId = nanoid26(16);
-  return awaitResult(
-    requestId,
-    () => sendToFarm(farmId, { type: "delete_project", requestId, projectId }),
-    timeoutMs
-  );
-}
-function requestRespawn(farmId, projectId, timeoutMs) {
-  const requestId = nanoid26(16);
-  return awaitResult(
-    requestId,
-    () => sendToFarm(farmId, { type: "respawn_project", requestId, projectId }),
-    timeoutMs
-  );
-}
-async function requestFarmPoolSync(db, farmId) {
-  const accounts = await computeFarmPoolSpec(db, farmId);
-  sendToFarm(farmId, buildSyncWorkerPoolMessage(accounts));
-}
-var pending2, RESULT_TYPES;
-var init_provision = __esm({
-  "src/farm/provision.ts"() {
-    "use strict";
-    init_ws();
-    init_pool_spec();
-    pending2 = /* @__PURE__ */ new Map();
-    RESULT_TYPES = /* @__PURE__ */ new Set(["provision_result", "delete_result", "respawn_result"]);
+    init_route_registry();
   }
 });
 
 // src/routes/farm.ts
-import { nanoid as nanoid27 } from "nanoid";
+import { nanoid as nanoid25 } from "nanoid";
 function viewerInAssignments(viewer, assignments) {
   return assignments.some(
     (a) => viewer.userId !== null && a.userId === viewer.userId || a.email !== null && a.email === viewer.email
@@ -26056,8 +26084,15 @@ async function farmRoutes(app, deps) {
   const { db, config } = deps;
   const registerByIp = createAbuseThrottle({ windowMs: 15 * 6e4, max: 10 });
   app.post(
-    "/farm/register",
+    "/node/v1/farm/register",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.farm.register",
+        authPolicy: "public",
+        stability: "preview",
+        summary: "Register a FARM with the operator's registration token"
+      }),
       schema: {
         body: {
           type: "object",
@@ -26082,7 +26117,7 @@ async function farmRoutes(app, deps) {
       if (req.body.registrationToken !== config.farmRegistrationToken) {
         return reply.status(401).send({ error: "bad_registration_token" });
       }
-      const token = nanoid27(48);
+      const token = nanoid25(48);
       const now = Date.now();
       const publicKey = req.body.publicKey ?? null;
       const fingerprint2 = publicKey ? publicKeyFingerprint(publicKey) : null;
@@ -26121,7 +26156,7 @@ async function farmRoutes(app, deps) {
           "farm registered under an existing name with a DIFFERENT key \u2014 new identity; assignments stay with the old farm and must be moved deliberately"
         );
       }
-      const id = `farm_${nanoid27(16)}`;
+      const id = `farm_${nanoid25(16)}`;
       await db.run(`INSERT INTO farms
            (id, name, token, capabilities_json, public_key, key_fingerprint, registered_at, last_seen_at, max_sandboxes)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, id, req.body.name, token, JSON.stringify(req.body.capabilities), publicKey, fingerprint2, now, now, maxSandboxes);
@@ -26129,104 +26164,26 @@ async function farmRoutes(app, deps) {
       return { farmId: id, token };
     }
   );
-  app.get("/farms", async (req, reply) => {
-    const auth = await resolveCliAuth(db, config, req.headers.authorization);
-    if (auth) {
-      return await listFarms(db, {
-        email: auth.email,
-        userId: auth.userId,
-        isSuperAdmin: isSuperUser(config, auth.email)
-      });
-    }
-    const session = await requireSession(db, req, reply);
-    if (!session) return reply;
-    return await listFarms(db, {
-      email: session.email,
-      userId: session.userId,
-      isSuperAdmin: isSuperUser(config, session.email)
-    });
-  });
-  app.post(
-    "/farms/:farmId/provision",
-    {
-      schema: {
-        body: {
-          type: "object",
-          required: ["projectId", "sealedBundle"],
-          properties: {
-            projectId: { type: "string" },
-            sealedBundle: { type: "string", minLength: 1 }
-          }
-        }
-      }
-    },
-    async (req, reply) => {
-      const auth = await resolveCliAuth(db, config, req.headers.authorization);
-      if (!auth) {
-        return reply.status(401).send({ error: "unauthorized" });
-      }
-      const { farmId } = req.params;
-      const { projectId, sealedBundle } = req.body;
-      if (!await canActOnProject(db, config, auth, projectId)) {
-        return reply.status(403).send({ error: "forbidden" });
-      }
-      const farm = await db.get(`SELECT id FROM farms WHERE id = ?`, farmId);
-      if (!farm) return reply.status(404).send({ error: "unknown_farm" });
-      if (!isSuperUser(config, auth.email) && !await viewerOwnsFarm(db, { email: auth.email, userId: auth.userId }, farmId)) {
-        return reply.status(403).send({ error: "farm_not_assigned" });
-      }
-      if (!await db.get(`SELECT id FROM projects WHERE id = ?`, projectId)) {
-        return reply.status(404).send({ error: "unknown_project" });
-      }
-      await beginInitTracking(db, projectId, "farm_provisioning");
-      try {
-        const result = await requestProvision(farmId, projectId, sealedBundle, 6e4);
-        if (result.ok) {
-          await db.run(`UPDATE projects SET farm_id = ? WHERE id = ?`, farmId, projectId);
-          await advanceInitPhase(db, projectId, "daemon_starting");
-          requestFarmPoolSync(db, farmId).catch(
-            (err) => app.log.warn({ farmId, err }, "farm pool sync after provision failed")
-          );
-        } else {
-          await recordInitError(db, projectId, `farm provisioning failed: ${result.error ?? "unknown error"}`);
-        }
-        return result;
-      } catch (err) {
-        const reason = err instanceof Error ? err.message : "provision_failed";
-        await recordInitError(
-          db,
-          projectId,
-          reason === "farm_offline" ? "the hosting farm is offline" : reason === "farm_timeout" ? "the hosting farm did not respond in time" : `farm provisioning failed: ${reason}`
-        );
-        const status = reason === "farm_offline" ? 409 : reason === "farm_timeout" ? 504 : 500;
-        return reply.status(status).send({ error: reason });
-      }
-    }
-  );
 }
 var init_farm2 = __esm({
   "src/routes/farm.ts"() {
     "use strict";
     init_sealedbox();
     init_abuse_throttle();
-    init_cli_auth();
-    init_auth();
-    init_users();
-    init_init_status();
     init_ws();
-    init_provision();
+    init_route_registry();
   }
 });
 
 // src/runner-reg-tokens.ts
 import { createHash as createHash8 } from "node:crypto";
-import { nanoid as nanoid28 } from "nanoid";
+import { nanoid as nanoid26 } from "nanoid";
 function hashRunnerRegToken(secret) {
   return createHash8("sha256").update(secret, "utf8").digest("hex");
 }
 async function issueRunnerRegToken(db, email) {
   const normalized = email.trim().toLowerCase();
-  const secret = `rnrreg_${nanoid28(48)}`;
+  const secret = `rnrreg_${nanoid26(48)}`;
   await db.tx(async (db2) => {
     await db2.run(`UPDATE runner_reg_tokens SET revoked_at = ? WHERE email = ? AND revoked_at IS NULL`, Date.now(), normalized);
     await db2.run(`INSERT INTO runner_reg_tokens (token_hash, email, user_id, created_at)
@@ -26262,130 +26219,8 @@ var init_runner_reg_tokens = __esm({
   }
 });
 
-// src/runner/provision.ts
-import { nanoid as nanoid29 } from "nanoid";
-function handleRunnerResult(msg) {
-  const type = msg["type"];
-  if (typeof type !== "string" || !RESULT_TYPES2.has(type)) return;
-  const requestId = typeof msg["requestId"] === "string" ? msg["requestId"] : "";
-  const p = pending3.get(requestId);
-  if (!p) return;
-  clearTimeout(p.timer);
-  pending3.delete(requestId);
-  p.resolve(msg);
-}
-function awaitResult2(requestId, send, timeoutMs) {
-  if (!send()) return Promise.reject(new Error("runner_offline"));
-  return new Promise((resolve4, reject) => {
-    const timer = setTimeout(() => {
-      pending3.delete(requestId);
-      reject(new Error("runner_timeout"));
-    }, timeoutMs);
-    pending3.set(requestId, { resolve: resolve4, reject, timer });
-  });
-}
-function requestGhRunnersProvision(runnerId, projectId, sealedBundle, timeoutMs) {
-  const requestId = nanoid29(16);
-  return awaitResult2(
-    requestId,
-    () => sendToRunner(runnerId, { type: "provision_gh_runners", requestId, projectId, sealedBundle }),
-    timeoutMs
-  );
-}
-function requestGhRunnersDelete(runnerId, projectId, sealedBundle, timeoutMs) {
-  const requestId = nanoid29(16);
-  return awaitResult2(
-    requestId,
-    () => sendToRunner(runnerId, {
-      type: "delete_gh_runners",
-      requestId,
-      projectId,
-      ...sealedBundle ? { sealedBundle } : {}
-    }),
-    timeoutMs
-  );
-}
-var pending3, RESULT_TYPES2;
-var init_provision2 = __esm({
-  "src/runner/provision.ts"() {
-    "use strict";
-    init_ws();
-    pending3 = /* @__PURE__ */ new Map();
-    RESULT_TYPES2 = /* @__PURE__ */ new Set(["provision_gh_runners_result", "delete_gh_runners_result"]);
-  }
-});
-
-// src/runner/bindings.ts
-function parseGhRunnerBindings(json) {
-  if (!json) return [];
-  try {
-    const parsed = JSON.parse(json);
-    return Array.isArray(parsed.bindings) ? parsed.bindings : [];
-  } catch {
-    return [];
-  }
-}
-function serialize(bindings) {
-  return JSON.stringify({ bindings });
-}
-async function upsertGhRunnerBinding(db, projectId, binding) {
-  await db.tx(async (tx) => {
-    const row = await tx.get(
-      `SELECT gh_runner_bindings_json as bindingsJson FROM projects WHERE id = ?`,
-      projectId
-    );
-    if (!row) return;
-    const bindings = parseGhRunnerBindings(row.bindingsJson).filter(
-      (b) => !(b.owner === binding.owner && b.repo === binding.repo)
-    );
-    bindings.push(binding);
-    await tx.run(
-      `UPDATE projects SET gh_runner_bindings_json = ? WHERE id = ?`,
-      serialize(bindings),
-      projectId
-    );
-  });
-}
-async function removeGhRunnerBinding(db, projectId, owner, repo) {
-  return db.tx(async (tx) => {
-    const row = await tx.get(
-      `SELECT gh_runner_bindings_json as bindingsJson FROM projects WHERE id = ?`,
-      projectId
-    );
-    if (!row) return false;
-    const bindings = parseGhRunnerBindings(row.bindingsJson);
-    const kept = bindings.filter((b) => !(b.owner === owner && b.repo === repo));
-    if (kept.length === bindings.length) return false;
-    await tx.run(
-      `UPDATE projects SET gh_runner_bindings_json = ? WHERE id = ?`,
-      serialize(kept),
-      projectId
-    );
-    return true;
-  });
-}
-async function runnerBoundProjectCount(db, runnerId) {
-  const rows = await db.all(
-    `SELECT gh_runner_bindings_json AS json FROM projects WHERE gh_runner_bindings_json IS NOT NULL`
-  );
-  let n = 0;
-  for (const r of rows) {
-    try {
-      const bindings = JSON.parse(r.json).bindings ?? [];
-      if (bindings.some((b) => b.runnerId === runnerId)) n++;
-    } catch {
-    }
-  }
-  return n;
-}
-var init_bindings = __esm({
-  "src/runner/bindings.ts"() {
-    "use strict";
-  }
-});
-
 // src/routes/runner.ts
-import { nanoid as nanoid30 } from "nanoid";
+import { nanoid as nanoid27 } from "nanoid";
 async function listRunners(db, viewer) {
   const online = new Set(listConnectedRunnerIds());
   const rows = await db.all(`SELECT id, name, public_key as publicKey,
@@ -26438,8 +26273,15 @@ async function runnerRoutes(app, deps) {
   const { db, config } = deps;
   const registerByIp = createAbuseThrottle({ windowMs: 15 * 6e4, max: 10 });
   app.post(
-    "/runner/register",
+    "/node/v1/runner/register",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.runner.register",
+        authPolicy: "public",
+        stability: "preview",
+        summary: "Register a RUNNER host with a personal registration token"
+      }),
       schema: {
         body: {
           type: "object",
@@ -26462,8 +26304,8 @@ async function runnerRoutes(app, deps) {
       if (!owner) {
         return reply.status(401).send({ error: "bad_registration_token" });
       }
-      const id = `rnr_${nanoid30(16)}`;
-      const token = nanoid30(48);
+      const id = `rnr_${nanoid27(16)}`;
+      const token = nanoid27(48);
       const now = Date.now();
       const publicKey = req.body.publicKey ?? null;
       const fingerprint2 = publicKey ? publicKeyFingerprint(publicKey) : null;
@@ -26531,108 +26373,6 @@ async function runnerRoutes(app, deps) {
       return { ok: true };
     }
   );
-  const ghRunnerGuard = async (authorization, reply, runnerId, projectId) => {
-    const auth = await resolveCliAuth(db, config, authorization);
-    if (!auth) {
-      reply.status(401).send({ error: "unauthorized" });
-      return null;
-    }
-    if (!await canActOnProject(db, config, auth, projectId)) {
-      reply.status(403).send({ error: "forbidden" });
-      return null;
-    }
-    if (!await db.get(`SELECT id FROM runners WHERE id = ?`, runnerId)) {
-      reply.status(404).send({ error: "unknown_runner" });
-      return null;
-    }
-    if (!isSuperUser(config, auth.email) && !await viewerOwnsRunner(db, { email: auth.email, userId: auth.userId }, runnerId)) {
-      reply.status(403).send({ error: "runner_not_owned" });
-      return null;
-    }
-    if (!await db.get(`SELECT id FROM projects WHERE id = ?`, projectId)) {
-      reply.status(404).send({ error: "unknown_project" });
-      return null;
-    }
-    return auth;
-  };
-  const ghRelayFailure = (reply, err) => {
-    const reason = err instanceof Error ? err.message : "gh_runner_relay_failed";
-    const status = reason === "runner_offline" ? 409 : reason === "runner_timeout" ? 504 : 500;
-    return reply.status(status).send({ error: reason });
-  };
-  app.post(
-    "/runners/:runnerId/gh-runners",
-    {
-      schema: {
-        body: {
-          type: "object",
-          required: ["projectId", "sealedBundle"],
-          properties: {
-            projectId: { type: "string" },
-            sealedBundle: { type: "string", minLength: 1 }
-          }
-        }
-      }
-    },
-    async (req, reply) => {
-      const { runnerId } = req.params;
-      const { projectId, sealedBundle } = req.body;
-      if (!await ghRunnerGuard(req.headers.authorization, reply, runnerId, projectId)) return reply;
-      try {
-        const result = await requestGhRunnersProvision(runnerId, projectId, sealedBundle, 12e4);
-        if (result.ok) {
-          const connectedAt = Date.now();
-          for (const r of result.runners ?? []) {
-            await upsertGhRunnerBinding(db, projectId, {
-              owner: r.owner,
-              repo: r.repo,
-              runnerId,
-              connectedAt,
-              status: r.status,
-              ...r.error ? { error: r.error } : {},
-              ...r.labels ? { labels: r.labels } : {}
-            });
-          }
-        }
-        return result;
-      } catch (err) {
-        return ghRelayFailure(reply, err);
-      }
-    }
-  );
-  app.post(
-    "/runners/:runnerId/gh-runners/teardown",
-    {
-      schema: {
-        body: {
-          type: "object",
-          required: ["projectId"],
-          properties: {
-            projectId: { type: "string" },
-            sealedBundle: { type: "string", minLength: 1 },
-            // DEV-530: the one repo being disconnected — plaintext public
-            // identifiers (not secrets), so the HUB can drop its binding.
-            owner: { type: "string", minLength: 1 },
-            repo: { type: "string", minLength: 1 }
-          }
-        }
-      }
-    },
-    async (req, reply) => {
-      const { runnerId } = req.params;
-      const { projectId, sealedBundle, owner, repo } = req.body;
-      if (!await ghRunnerGuard(req.headers.authorization, reply, runnerId, projectId)) return reply;
-      try {
-        const result = await requestGhRunnersDelete(runnerId, projectId, sealedBundle, 12e4);
-        if (result.ok && owner && repo) {
-          await removeGhRunnerBinding(db, projectId, owner, repo);
-        }
-        return result;
-      } catch (err) {
-        return ghRelayFailure(reply, err);
-      }
-    }
-  );
 }
 var init_runner2 = __esm({
   "src/routes/runner.ts"() {
@@ -26644,8 +26384,93 @@ var init_runner2 = __esm({
     init_users();
     init_runner_reg_tokens();
     init_ws();
-    init_provision2();
-    init_bindings();
+    init_route_registry();
+  }
+});
+
+// src/farm/pool-spec.ts
+var pool_spec_exports = {};
+__export(pool_spec_exports, {
+  buildSyncWorkerPoolMessage: () => buildSyncWorkerPoolMessage,
+  computeFarmPoolSpec: () => computeFarmPoolSpec,
+  reconcileFarmPools: () => reconcileFarmPools
+});
+import { nanoid as nanoid28 } from "nanoid";
+async function computeFarmPoolSpec(db, farmId) {
+  const rows = await db.all(
+    `SELECT fa.user_id as userId, fa.max_sandboxes as quota,
+            p.id as projectId
+       FROM farm_assignments fa
+       JOIN projects p ON p.farm_id = fa.farm_id AND p.owner_user_id = fa.user_id
+      WHERE fa.farm_id = ?
+      ORDER BY fa.assigned_at ASC, p.id ASC`,
+    farmId
+  );
+  const ceilingRow = await db.get(
+    `SELECT max_sandboxes as ceiling FROM farms WHERE id = ?`,
+    farmId
+  );
+  const ceiling = ceilingRow ? Number(ceilingRow.ceiling) : 16;
+  const byAccount = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const acc = byAccount.get(r.userId) ?? { quota: Number(r.quota), projectIds: [] };
+    acc.projectIds.push(r.projectId);
+    byAccount.set(r.userId, acc);
+  }
+  const spec = [];
+  let remaining = ceiling;
+  for (const [userId, acc] of byAccount) {
+    const quota = Math.max(0, Math.min(acc.quota, remaining));
+    remaining -= quota;
+    spec.push({ userId, projectIds: acc.projectIds, quota });
+  }
+  return spec;
+}
+function buildSyncWorkerPoolMessage(accounts) {
+  return { type: "sync_worker_pool", requestId: nanoid28(16), accounts };
+}
+async function reconcileFarmPools(db, send, log) {
+  const farms = await db.all(`SELECT id FROM farms`);
+  const live = new Set(farms.map((f) => f.id));
+  for (const id of [...starvationReported]) {
+    if (!live.has(id)) starvationReported.delete(id);
+  }
+  const starved = [];
+  let pushed = 0;
+  for (const farm of farms) {
+    const accounts = await computeFarmPoolSpec(db, farm.id);
+    if (accounts.length > 0) {
+      const sent = send(farm.id, buildSyncWorkerPoolMessage(accounts));
+      if (sent !== false) pushed++;
+      starvationReported.delete(farm.id);
+      continue;
+    }
+    const queued = await db.get(
+      `SELECT COUNT(*) AS n FROM jobs j
+         JOIN projects p ON p.id = j.project_id
+        WHERE j.state = 'queued' AND p.farm_id = ?`,
+      farm.id
+    );
+    if (Number(queued.n) === 0) {
+      starvationReported.delete(farm.id);
+      continue;
+    }
+    starved.push(farm.id);
+    if (!starvationReported.has(farm.id)) {
+      starvationReported.add(farm.id);
+      log.warn(
+        { farmId: farm.id, queued: Number(queued.n) },
+        "farm has NO worker-pool accounts while jobs are queued \u2014 assignments missing?"
+      );
+    }
+  }
+  return { farms: farms.length, pushed, starved };
+}
+var starvationReported;
+var init_pool_spec = __esm({
+  "src/farm/pool-spec.ts"() {
+    "use strict";
+    starvationReported = /* @__PURE__ */ new Set();
   }
 });
 
@@ -26905,25 +26730,25 @@ async function requestGrantsFrom(spec, recipient, bindingVersion, log, timeoutMs
   const requestId = msg.requestId;
   return await new Promise((resolve4) => {
     const timer = setTimeout(() => {
-      pending4.delete(requestId);
+      pending2.delete(requestId);
       log.warn({ projectId: spec.projectId, jobId: spec.jobId, sandboxId: recipient.sandboxId }, "credential grants: CLI did not answer in time");
       resolve4(null);
     }, timeoutMs);
-    pending4.set(requestId, {
+    pending2.set(requestId, {
       projectId: spec.projectId,
       jobId: spec.jobId,
       sandboxId: recipient.sandboxId,
       holder,
       resolve: (answer) => {
         clearTimeout(timer);
-        pending4.delete(requestId);
+        pending2.delete(requestId);
         resolve4(answer);
       }
     });
     const sent = holder.kind === "provider" ? sendToAgentLoginProvider(holder.ownerKey, holder.providerId, msg) : sendToProjectCli(spec.projectId, msg);
     if (!sent) {
       clearTimeout(timer);
-      pending4.delete(requestId);
+      pending2.delete(requestId);
       resolve4(null);
     }
   });
@@ -26934,7 +26759,7 @@ function acceptCredentialGrants(msg, from) {
     return { ok: false, reason: "malformed" };
   }
   if (typeof from === "string" && m.projectId !== from) return { ok: false, reason: "cross-project" };
-  const req = pending4.get(m.requestId);
+  const req = pending2.get(m.requestId);
   if (!req) return { ok: false, reason: NO_PENDING_REQUEST };
   if (typeof from === "string") {
     if (req.holder.kind !== "client") return { ok: false, reason: "answer from a holder that was not asked" };
@@ -27140,15 +26965,15 @@ async function sweepExpiredGrants(db, now = Date.now()) {
   return changes;
 }
 function resolvePendingGrantRequest(requestId, answer) {
-  const req = pending4.get(requestId);
+  const req = pending2.get(requestId);
   if (!req) return false;
   req.resolve(answer);
   return true;
 }
 function pendingGrantRequests() {
-  return pending4.size;
+  return pending2.size;
 }
-var GRANT_REQUEST_TIMEOUT_MS, pending4, NO_PENDING_REQUEST, LATE_ANSWER_TTL_MS, lateAnswers;
+var GRANT_REQUEST_TIMEOUT_MS, pending2, NO_PENDING_REQUEST, LATE_ANSWER_TTL_MS, lateAnswers;
 var init_credential_grants = __esm({
   "src/tracker/credential-grants.ts"() {
     "use strict";
@@ -27159,7 +26984,7 @@ var init_credential_grants = __esm({
     init_ws();
     init_sandbox_keys();
     GRANT_REQUEST_TIMEOUT_MS = 6e3;
-    pending4 = /* @__PURE__ */ new Map();
+    pending2 = /* @__PURE__ */ new Map();
     NO_PENDING_REQUEST = "no pending request";
     LATE_ANSWER_TTL_MS = 6e4;
     lateAnswers = /* @__PURE__ */ new Map();
@@ -27739,23 +27564,11 @@ function installSocketKeepalive(socket, periodMs) {
 }
 async function wsRoutes(app, deps) {
   const { db, config } = deps;
-  async function authenticateSocket(req, component, resolve4) {
-    for (const secret of readNodeSocketSecrets(req.headers, req.query)) {
-      const resolved = await resolve4(secret.token);
-      if (resolved === null || resolved === void 0) continue;
-      if (secret.source === "query") warnAboutQueryCredential(component, req.ip ?? null);
-      return resolved;
-    }
-    return null;
-  }
-  const warnedComponents = /* @__PURE__ */ new Set();
-  function warnAboutQueryCredential(component, remote) {
-    if (warnedComponents.has(component)) return;
-    warnedComponents.add(component);
-    app.log.warn(
-      { component, remote },
-      "node socket authenticated from the query string \u2014 the credential lands in proxy logs; update the component to send it in the Authorization header (this is logged once)"
-    );
+  async function authenticateSocket(req, resolve4) {
+    const token = readNodeSocketSecret(req.headers);
+    if (token === null) return null;
+    const resolved = await resolve4(token);
+    return resolved === null || resolved === void 0 ? null : resolved;
   }
   const cliSocket = async (socket, req) => {
     let boundProjectId = null;
@@ -28092,7 +27905,7 @@ async function wsRoutes(app, deps) {
         app.log.info({ remote: req.ip }, "CLI socket closed (never registered)");
       }
     });
-    auth = await authenticateSocket(req, "cli", (token) => authFromSecret(db, config, token));
+    auth = await authenticateSocket(req, (token) => authFromSecret(db, config, token));
     if (!auth) {
       socket.close(1008, "unauthorized");
       return;
@@ -28110,7 +27923,7 @@ async function wsRoutes(app, deps) {
     void pump();
   };
   const sandboxSocket = async (socket, req) => {
-    const sandbox = await authenticateSocket(req, "sandbox", (token) => findSandboxByToken(db, token));
+    const sandbox = await authenticateSocket(req, (token) => findSandboxByToken(db, token));
     if (!sandbox) {
       socket.close(1008, "unauthorized");
       return;
@@ -28228,7 +28041,7 @@ async function wsRoutes(app, deps) {
     });
   };
   const farmSocket = async (socket, req) => {
-    const farm = await authenticateSocket(req, "farm", (token) => findFarmByToken(db, token));
+    const farm = await authenticateSocket(req, (token) => findFarmByToken(db, token));
     if (!farm) {
       socket.close(1008, "unauthorized");
       return;
@@ -28320,7 +28133,7 @@ async function wsRoutes(app, deps) {
     });
   };
   const runnerSocket = async (socket, req) => {
-    const runner = await authenticateSocket(req, "runner", (token) => findRunnerByToken(db, token));
+    const runner = await authenticateSocket(req, (token) => findRunnerByToken(db, token));
     if (!runner) {
       socket.close(1008, "unauthorized");
       return;
@@ -28452,10 +28265,12 @@ async function wsRoutes(app, deps) {
         }
         const auth = parseNodeAuth(parsed);
         if (auth !== null) {
-          if (auth.component !== component || !await authenticate({ ...req, headers: { authorization: `Bearer ${auth.token}` } })) {
+          const withFrameCredential = { ...req, headers: { ...req.headers, authorization: `Bearer ${auth.token}` } };
+          if (auth.component !== component || !await authenticate(withFrameCredential)) {
             refuse("unauthenticated");
             return;
           }
+          effectiveReq = withFrameCredential;
           authenticated = true;
           return;
         }
@@ -28492,7 +28307,7 @@ async function wsRoutes(app, deps) {
         socket.off("message", listener);
         socket.pause();
         try {
-          await inner(socket, req);
+          await inner(socket, effectiveReq);
         } catch (err) {
           app.log.error({ err, component }, "node socket handler failed after handshake");
           socket.close(1011, "handler_failed");
@@ -28503,6 +28318,7 @@ async function wsRoutes(app, deps) {
         socket.resume();
       };
       let authenticated = false;
+      let effectiveReq = req;
       const ready = authenticate(req).then((ok2) => {
         authenticated = ok2;
       });
@@ -28536,7 +28352,6 @@ async function wsRoutes(app, deps) {
       });
     }
   }
-  app.get("/cli/connect", { websocket: true }, cliSocket);
   app.get(
     "/node/v1/cli/connect",
     {
@@ -28550,9 +28365,8 @@ async function wsRoutes(app, deps) {
         summary: "Control socket of a CLI instance"
       })
     },
-    withNodeHandshake("cli", async (r) => await authenticateSocket(r, "cli", (token) => authFromSecret(db, config, token)) !== null, cliSocket)
+    withNodeHandshake("cli", async (r) => await authenticateSocket(r, (token) => authFromSecret(db, config, token)) !== null, cliSocket)
   );
-  app.get("/sandbox/connect", { websocket: true }, sandboxSocket);
   app.get(
     "/node/v1/sandbox/connect",
     {
@@ -28566,9 +28380,8 @@ async function wsRoutes(app, deps) {
         summary: "Control socket of a SANDBOX instance"
       })
     },
-    withNodeHandshake("sandbox", async (r) => await authenticateSocket(r, "sandbox", (token) => findSandboxByToken(db, token)) !== null, sandboxSocket)
+    withNodeHandshake("sandbox", async (r) => await authenticateSocket(r, (token) => findSandboxByToken(db, token)) !== null, sandboxSocket)
   );
-  app.get("/farm/connect", { websocket: true }, farmSocket);
   app.get(
     "/node/v1/farm/connect",
     {
@@ -28582,9 +28395,8 @@ async function wsRoutes(app, deps) {
         summary: "Control socket of a FARM instance"
       })
     },
-    withNodeHandshake("farm", async (r) => await authenticateSocket(r, "farm", (token) => findFarmByToken(db, token)) !== null, farmSocket)
+    withNodeHandshake("farm", async (r) => await authenticateSocket(r, (token) => findFarmByToken(db, token)) !== null, farmSocket)
   );
-  app.get("/runner/connect", { websocket: true }, runnerSocket);
   app.get(
     "/node/v1/runner/connect",
     {
@@ -28598,7 +28410,7 @@ async function wsRoutes(app, deps) {
         summary: "Control socket of a RUNNER instance"
       })
     },
-    withNodeHandshake("runner", async (r) => await authenticateSocket(r, "runner", (token) => findRunnerByToken(db, token)) !== null, runnerSocket)
+    withNodeHandshake("runner", async (r) => await authenticateSocket(r, (token) => findRunnerByToken(db, token)) !== null, runnerSocket)
   );
 }
 var agentLoginProviders, deliveryFollowers, projectCliConnections, projectLastSeenAt, projectLastDuplicateRegisterAt, sandboxConnections, farmConnections, runnerConnections, cliMessageHandlers, cliRegisterHandlers, cliDisconnectHandlers, farmMessageHandlers, runnerMessageHandlers, providerMessageHandlers, RECOGNIZED_NODE_CAPABILITIES, NODE_HANDSHAKE_BACKLOG, NODE_HANDSHAKE_TIMEOUT_MS;
@@ -29078,7 +28890,7 @@ function installOfflineSweeper(deps) {
 init_dist5();
 import { existsSync as existsSync4 } from "node:fs";
 import staticPlugin from "@fastify/static";
-import { nanoid as nanoid31 } from "nanoid";
+import { nanoid as nanoid29 } from "nanoid";
 
 // src/http/browser-routes.ts
 init_route_definition();
@@ -29193,9 +29005,22 @@ var RETIRED_SOCKET_PATHS = [
   "/farm/connect",
   "/runner/connect"
 ];
+var RETIRED_NODE_PATHS = [
+  "/jobs/claim",
+  "/jobs/heartbeat",
+  "/jobs/release",
+  "/jobs/result",
+  "/sandbox/register",
+  "/sandbox/me",
+  "/sandbox/agent-auth",
+  "/sandbox/agent-auth/result",
+  "/sandbox/reg-token/cli",
+  "/farm/register",
+  "/runner/register"
+];
 function isRetiredClientPath(url, registeredPaths = []) {
   const path = url.split("?")[0].split("#")[0];
-  if (RETIRED_SOCKET_PATHS.includes(path)) return !registeredPaths.includes(path);
+  if (RETIRED_SOCKET_PATHS.includes(path) || RETIRED_NODE_PATHS.includes(path)) return !registeredPaths.includes(path);
   const retired = RETIRED_ROOTS.find((root) => path === root || path.startsWith(`${root}/`));
   if (retired === void 0) return false;
   return !registeredPaths.some((p) => p === retired || p.startsWith(`${retired}/`));
@@ -29239,7 +29064,7 @@ async function registerSpaHosts(app, opts) {
       return onConsole ? reply.sendFile("index.html", adminDist) : reply.sendFile("index.html");
     }
     const failure = isRetiredClientPath(req.url, opts.registeredPaths ?? []) ? clientTooOldError() : errors.notFound();
-    const rendered = renderError(failure, `req_${nanoid31(16)}`);
+    const rendered = renderError(failure, `req_${nanoid29(16)}`);
     return reply.status(rendered.status).send(rendered.body);
   });
 }
@@ -29253,7 +29078,7 @@ import { createHash as createHash9, randomBytes as randomBytes3 } from "node:cry
 import { existsSync as existsSync5, readFileSync as readFileSync3 } from "node:fs";
 import { join as join4 } from "node:path";
 init_dist5();
-import { nanoid as nanoid32 } from "nanoid";
+import { nanoid as nanoid30 } from "nanoid";
 var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
 var nonces = /* @__PURE__ */ new WeakMap();
 function cspNonce(req) {
@@ -29342,7 +29167,7 @@ function installBrowserSecurity(app, config, options = {}) {
         message: "This request did not come from an allowed origin.",
         details: { reason: verdict.reason }
       }),
-      `req_${nanoid32(16)}`
+      `req_${nanoid30(16)}`
     );
     await reply.status(rendered.status).send(rendered.body);
   });
@@ -29470,7 +29295,7 @@ init_route_registry();
 
 // src/routes/api-v1/context.ts
 init_dist5();
-import { nanoid as nanoid33 } from "nanoid";
+import { nanoid as nanoid31 } from "nanoid";
 
 // src/auth/resolve-principal.ts
 init_auth();
@@ -29596,7 +29421,7 @@ async function resolveSession(db, req, surface, base) {
 
 // src/routes/api-v1/context.ts
 function requestIdOf(_req) {
-  return `req_${nanoid33(16)}`;
+  return `req_${nanoid31(16)}`;
 }
 async function actorOr401(deps, req, reply, requestId) {
   const resolution = await resolvePrincipal({
@@ -30009,6 +29834,49 @@ async function apiV1ReadRoutes(app, deps) {
       }
     }
   );
+  app.get(
+    "/projects/:projectId/deliverables",
+    routeMeta({
+      surface: "application",
+      operationId: "project.deliverables",
+      authPolicy: "application_actor",
+      resourcePolicy: "delivery.read",
+      stability: "preview",
+      summary: "Tasks whose branches a developer's clone can pull"
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        const { projectId } = req.params;
+        return await read.listProjectDeliverables(actor, { projectId });
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
+  app.get(
+    "/farms",
+    routeMeta({
+      surface: "application",
+      operationId: "farm.list",
+      authPolicy: "application_actor",
+      resourcePolicy: "account.read",
+      stability: "preview",
+      summary: "Farms assigned to the caller's account"
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        return await read.listFarms(actor);
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
   app.get(
     "/projects/:projectId/config-proposals",
     routeMeta({
@@ -30558,6 +30426,101 @@ var OBSERVER_PASS_BODY = {
   additionalProperties: false,
   properties: { note: { type: "string", maxLength: 4e3 } }
 };
+var CREATE_PROJECT_BODY = {
+  type: "object",
+  additionalProperties: false,
+  required: ["projectId", "name", "automationLevel", "repos", "contextRepo"],
+  properties: {
+    projectId: { type: "string", minLength: 2, maxLength: 31 },
+    name: { type: "string", minLength: 1, maxLength: 200 },
+    automationLevel: { type: "string", enum: ["assisted", "full"] },
+    trackerProvider: { type: "string", enum: ["internal", "youtrack"] },
+    trackerProjectKey: { type: "string", minLength: 1, maxLength: 64 },
+    repos: {
+      type: "array",
+      maxItems: 100,
+      items: {
+        ...REPO_BODY,
+        properties: {
+          ...REPO_BODY.properties,
+          mirror: {
+            type: "object",
+            additionalProperties: false,
+            required: ["host", "owner", "repoName"],
+            properties: {
+              host: { type: "string", enum: ["github", "bitbucket", "gitlab"] },
+              owner: { type: "string", minLength: 1, maxLength: 200 },
+              repoName: { type: "string", minLength: 1, maxLength: 200 }
+            },
+            description: "ADR-0041: the mirror the pipeline pushes this repository's branches to."
+          }
+        }
+      }
+    },
+    contextRepo: {
+      type: "object",
+      additionalProperties: false,
+      required: ["host", "owner", "name", "cloneUrl", "branch"],
+      properties: {
+        host: { type: "string", enum: ["github", "bitbucket", "gitlab", "local"] },
+        owner: { type: "string", minLength: 1, maxLength: 200 },
+        name: { type: "string", minLength: 1, maxLength: 200 },
+        cloneUrl: { type: "string", minLength: 1, maxLength: 2e3 },
+        branch: { type: "string", minLength: 1, maxLength: 250 }
+      }
+    },
+    language: {
+      type: "object",
+      maxProperties: 20,
+      additionalProperties: { type: "string", maxLength: 64 },
+      description: "DEV-551: per-section language chosen at init."
+    }
+  }
+};
+var SEALED_HANDOFF_BODY = {
+  type: "object",
+  additionalProperties: false,
+  required: ["projectId", "sealedBundle"],
+  properties: {
+    projectId: { type: "string", minLength: 1, maxLength: 64 },
+    sealedBundle: { type: "string", minLength: 1 }
+  }
+};
+var GH_RUNNERS_TEARDOWN_BODY = {
+  type: "object",
+  additionalProperties: false,
+  required: ["projectId"],
+  properties: {
+    projectId: { type: "string", minLength: 1, maxLength: 64 },
+    sealedBundle: { type: "string", minLength: 1 },
+    repo: {
+      type: "object",
+      additionalProperties: false,
+      required: ["owner", "repo"],
+      properties: {
+        owner: { type: "string", minLength: 1, maxLength: 200 },
+        repo: { type: "string", minLength: 1, maxLength: 200 }
+      },
+      description: "DEV-530: the one repository being disconnected, so its binding is dropped."
+    }
+  }
+};
+var PROJECT_INDEX_BODY = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    kind: { type: "string", enum: ["index", "backfill"], description: "Defaults to the ordinary index." }
+  }
+};
+var INIT_STATUS_BODY = {
+  type: "object",
+  additionalProperties: false,
+  required: ["phase"],
+  properties: {
+    phase: { type: "string", enum: ["context_cloning"] },
+    error: { type: "string", minLength: 1, maxLength: 500 }
+  }
+};
 function responseOf(body) {
   switch (body.decision) {
     case "answer":
@@ -30962,6 +30925,191 @@ async function apiV1MutationRoutes(app, deps) {
       }
     }
   );
+  app.post(
+    "/projects",
+    routeMeta({
+      surface: "application",
+      operationId: "project.create",
+      authPolicy: "application_actor",
+      resourcePolicy: "account.manage",
+      stability: "preview",
+      summary: "Register a project under the caller's account",
+      requestSchema: CREATE_PROJECT_BODY
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        const body = req.body;
+        const created = await commands.createProject(actor, {
+          project: {
+            projectId: body.projectId,
+            name: body.name,
+            automationLevel: body.automationLevel,
+            trackerProvider: body.trackerProvider ?? "youtrack",
+            trackerProjectKey: body.trackerProjectKey ?? null,
+            repos: body.repos,
+            contextRepo: body.contextRepo,
+            language: body.language ?? null
+          },
+          idempotencyKey: requiredIdempotencyKey(req)
+        });
+        return reply.status(201).header("location", `/api/v1/projects/${encodeURIComponent(created.projectId)}`).send(created);
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
+  app.post(
+    "/farms/:farmId/provision",
+    routeMeta({
+      surface: "application",
+      operationId: "farm.provision",
+      authPolicy: "application_actor",
+      resourcePolicy: "project.manage",
+      stability: "preview",
+      summary: "Hand a sealed project bundle to a farm and wait for its verdict",
+      requestSchema: SEALED_HANDOFF_BODY
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        const { farmId } = req.params;
+        const { projectId, sealedBundle } = req.body;
+        return await commands.provisionOnFarm(actor, { farmId, projectId, sealedBundle, idempotencyKey: requiredIdempotencyKey(req) });
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
+  app.post(
+    "/runners/:runnerId/gh-runners",
+    routeMeta({
+      surface: "application",
+      operationId: "runner.provisionGhRunners",
+      authPolicy: "application_actor",
+      resourcePolicy: "project.manage",
+      stability: "preview",
+      summary: "Relay a sealed GitHub-runner bundle to a runner host of the caller's",
+      requestSchema: SEALED_HANDOFF_BODY
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        const { runnerId } = req.params;
+        const { projectId, sealedBundle } = req.body;
+        return await commands.provisionGhRunners(actor, { runnerId, projectId, sealedBundle, idempotencyKey: requiredIdempotencyKey(req) });
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
+  app.post(
+    "/runners/:runnerId/gh-runners/teardown",
+    routeMeta({
+      surface: "application",
+      operationId: "runner.teardownGhRunners",
+      authPolicy: "application_actor",
+      resourcePolicy: "project.manage",
+      stability: "preview",
+      summary: "Tear the project's GitHub runners down on that host",
+      requestSchema: GH_RUNNERS_TEARDOWN_BODY
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        const { runnerId } = req.params;
+        const body = req.body;
+        return await commands.teardownGhRunners(actor, {
+          runnerId,
+          projectId: body.projectId,
+          sealedBundle: body.sealedBundle,
+          repo: body.repo,
+          idempotencyKey: requiredIdempotencyKey(req)
+        });
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
+  app.post(
+    "/projects/:projectId/index",
+    routeMeta({
+      surface: "application",
+      operationId: "project.index",
+      authPolicy: "application_actor",
+      resourcePolicy: "project.manage",
+      stability: "preview",
+      summary: "Queue the project's one-shot index, or its retrospective ADR backfill",
+      requestSchema: PROJECT_INDEX_BODY
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        const { projectId } = req.params;
+        const { kind } = req.body ?? {};
+        const queued = await commands.requestProjectIndex(actor, { projectId, kind: kind ?? "index", idempotencyKey: requiredIdempotencyKey(req) });
+        return reply.status(202).send(queued);
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
+  app.post(
+    "/workers/registration-token",
+    routeMeta({
+      surface: "application",
+      operationId: "worker.issueRegistrationToken",
+      authPolicy: "application_actor",
+      resourcePolicy: "account.manage",
+      stability: "preview",
+      summary: "Mint a single-use registration token for a worker of this account"
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        const issued = await commands.issueWorkerRegistrationToken(actor);
+        return reply.status(201).send(issued);
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
+  app.post(
+    "/projects/:projectId/init-status",
+    routeMeta({
+      surface: "application",
+      operationId: "project.reportInitStatus",
+      authPolicy: "application_actor",
+      resourcePolicy: "project.manage",
+      stability: "preview",
+      summary: "Report an init step the project's client took before it connected",
+      requestSchema: INIT_STATUS_BODY
+    }),
+    async (req, reply) => {
+      const requestId = requestIdOf(req);
+      try {
+        const actor = await actorOr401({ db, config }, req, reply, requestId);
+        if (!actor) return reply;
+        const { projectId } = req.params;
+        const { phase, error } = req.body;
+        return await commands.reportInitStatus(actor, { projectId, phase, error });
+      } catch (err) {
+        return sendError(reply, err, requestId);
+      }
+    }
+  );
   app.post(
     "/projects/:projectId/repos",
     routeMeta({
@@ -31766,7 +31914,7 @@ init_regimen_config();
 // src/projects/cred-updates.ts
 init_dist();
 init_ws();
-import { nanoid as nanoid34 } from "nanoid";
+import { nanoid as nanoid32 } from "nanoid";
 var CRED_KIND_NOT_REPLACEABLE = "cred_kind_not_replaceable";
 function checkCredKind(kind) {
   if (isCredKind(kind)) return { ok: true, kind };
@@ -31789,7 +31937,7 @@ async function retireNonReplaceableCredUpdates(db, log) {
   return changes;
 }
 async function enqueueCredUpdate(db, projectId, kind, sealed, requestedBy, log) {
-  const id = `cred_${nanoid34(16)}`;
+  const id = `cred_${nanoid32(16)}`;
   const now = Date.now();
   await db.run(
     `UPDATE cred_updates SET state = 'rejected', detail = 'superseded by a newer replacement', updated_at = ?
@@ -31908,6 +32056,7 @@ function installCredUpdateHandlers(db, log) {
 
 // src/application/read-model.ts
 init_ws();
+init_farm2();
 init_queue_view();
 init_state_machine2();
 init_delivery_decision();
@@ -32119,7 +32268,7 @@ function configProposalRow(stored) {
 }
 
 // src/config-proposals/state-machine.ts
-import { nanoid as nanoid35 } from "nanoid";
+import { nanoid as nanoid33 } from "nanoid";
 function rowToProposal(raw) {
   return {
     id: raw["id"],
@@ -32144,7 +32293,7 @@ var PROPOSAL_COLUMNS = `id, project_id as projectId, user_input as userInput, st
          created_at as createdAt, updated_at as updatedAt`;
 var PROPOSAL_SELECT = `SELECT ${PROPOSAL_COLUMNS} FROM config_proposals`;
 async function createProposal(db, projectId, userInput) {
-  const id = `cfp_${nanoid35(16)}`;
+  const id = `cfp_${nanoid33(16)}`;
   const now = Date.now();
   await db.run(
     `INSERT INTO config_proposals
@@ -32793,7 +32942,7 @@ async function projectDetailOf(db, projectId, raw) {
     actionErrors: getProjectActions(projectId)?.actionErrors ?? []
   };
 }
-function createReadModel(db) {
+function createReadModel(db, options = {}) {
   const SUBMISSION_COLUMNS = `${DRAFT_COLUMNS},
          (SELECT COUNT(*) FROM draft_tasks c WHERE c.parent_draft_id = draft_tasks.id) as childCount,
          EXISTS (SELECT 1 FROM tasks t
@@ -33485,6 +33634,35 @@ function createReadModel(db) {
       const p = await getPresence(db, { email: viewer.email ?? "", userId: viewer.subjectId });
       return presenceRowOf(p, new Set(viewer.projectIds));
     },
+    // --- the account's fleet (DEV-927) ---
+    async listFarms(viewer) {
+      const isOperator = viewer.email !== null && (options.isOperator?.(viewer.email) ?? false);
+      return await listFarms(db, { email: viewer.email ?? "", userId: viewer.subjectId, isSuperAdmin: isOperator });
+    },
+    async listProjectDeliverables(projectId) {
+      const rows = await db.all(
+        `SELECT id, tracker_issue_key AS "taskKey", title, phase, updated_at AS "updatedAt"
+           FROM tasks
+          WHERE project_id = ? AND (archived IS NULL OR archived = 0)
+            AND phase IN ('TRACKING', 'AWAITING_CLUSTER', 'DONE', 'NEEDS_MANUAL')
+          ORDER BY CASE WHEN phase IN ('TRACKING', 'AWAITING_CLUSTER') THEN 0 ELSE 1 END,
+                   updated_at DESC
+          LIMIT 50`,
+        projectId
+      );
+      const out = [];
+      for (const r of rows) {
+        const byRepo = await loadTaskBranchesByRepo(db, r.id);
+        const repos = Object.entries(byRepo).map(([repoName, b]) => ({
+          repoName,
+          branchName: b.branchName,
+          baseRef: b.baseRef
+        }));
+        if (repos.length === 0) continue;
+        out.push({ taskKey: r.taskKey, title: r.title, phase: r.phase, updatedAt: Number(r.updatedAt), repos });
+      }
+      return out;
+    },
     async readNotificationSettings(subjectId) {
       const user = await db.get(`SELECT 1 as hit FROM users WHERE id = ?`, subjectId);
       if (!user) return null;
@@ -33573,7 +33751,7 @@ init_state_machine();
 // src/drafts/publish.ts
 init_ws();
 init_state_machine();
-import { nanoid as nanoid36 } from "nanoid";
+import { nanoid as nanoid34 } from "nanoid";
 function firstNonBlank(...vals) {
   for (const v of vals) {
     if (v != null && v.trim() !== "") return v;
@@ -33581,7 +33759,7 @@ function firstNonBlank(...vals) {
   return "";
 }
 async function dispatchPublish(db, draft, targetStatus, log) {
-  const publishActionId = `dpub_${nanoid36(16)}`;
+  const publishActionId = `dpub_${nanoid34(16)}`;
   const title = firstNonBlank(draft.editedTitle, draft.generatedTitle);
   const body = firstNonBlank(draft.editedBody, draft.generatedBody);
   const project = await db.get(`SELECT youtrack_project_key as youtrackProjectKey FROM projects WHERE id = ?`, draft.projectId);
@@ -33727,7 +33905,7 @@ async function maybeAdvancePackage(db, parentDraftId, log) {
     log.info({ draftId: parentDraftId }, "package published (no links) \u2192 DONE");
     return;
   }
-  const linkActionId = `dpkg_${nanoid36(16)}`;
+  const linkActionId = `dpkg_${nanoid34(16)}`;
   const action = {
     type: "apply_tracker_links",
     draftId: parentDraftId,
@@ -33922,7 +34100,115 @@ async function discardDraft(db, draft, log) {
 init_dist5();
 init_regimen_write();
 init_ws();
-init_provision();
+
+// src/farm/provision.ts
+init_ws();
+init_pool_spec();
+import { nanoid as nanoid35 } from "nanoid";
+var pending3 = /* @__PURE__ */ new Map();
+var RESULT_TYPES = /* @__PURE__ */ new Set(["provision_result", "delete_result", "respawn_result"]);
+function handleFarmResult(msg) {
+  const type = msg["type"];
+  if (typeof type !== "string" || !RESULT_TYPES.has(type)) return;
+  const requestId = typeof msg["requestId"] === "string" ? msg["requestId"] : "";
+  const p = pending3.get(requestId);
+  if (!p) return;
+  clearTimeout(p.timer);
+  pending3.delete(requestId);
+  p.resolve(msg);
+}
+function awaitResult(requestId, send, timeoutMs) {
+  if (!send()) return Promise.reject(new Error("farm_offline"));
+  return new Promise((resolve4, reject) => {
+    const timer = setTimeout(() => {
+      pending3.delete(requestId);
+      reject(new Error("farm_timeout"));
+    }, timeoutMs);
+    pending3.set(requestId, { resolve: resolve4, reject, timer });
+  });
+}
+function requestProvision(farmId, projectId, sealedBundle, timeoutMs) {
+  const requestId = nanoid35(16);
+  return awaitResult(
+    requestId,
+    () => sendToFarm(farmId, { type: "provision_project", requestId, projectId, sealedBundle }),
+    timeoutMs
+  );
+}
+function requestDelete(farmId, projectId, timeoutMs) {
+  const requestId = nanoid35(16);
+  return awaitResult(
+    requestId,
+    () => sendToFarm(farmId, { type: "delete_project", requestId, projectId }),
+    timeoutMs
+  );
+}
+function requestRespawn(farmId, projectId, timeoutMs) {
+  const requestId = nanoid35(16);
+  return awaitResult(
+    requestId,
+    () => sendToFarm(farmId, { type: "respawn_project", requestId, projectId }),
+    timeoutMs
+  );
+}
+async function requestFarmPoolSync(db, farmId) {
+  const accounts = await computeFarmPoolSpec(db, farmId);
+  sendToFarm(farmId, buildSyncWorkerPoolMessage(accounts));
+}
+
+// src/runner/provision.ts
+init_ws();
+import { nanoid as nanoid36 } from "nanoid";
+var pending4 = /* @__PURE__ */ new Map();
+var RESULT_TYPES2 = /* @__PURE__ */ new Set(["provision_gh_runners_result", "delete_gh_runners_result"]);
+function handleRunnerResult(msg) {
+  const type = msg["type"];
+  if (typeof type !== "string" || !RESULT_TYPES2.has(type)) return;
+  const requestId = typeof msg["requestId"] === "string" ? msg["requestId"] : "";
+  const p = pending4.get(requestId);
+  if (!p) return;
+  clearTimeout(p.timer);
+  pending4.delete(requestId);
+  p.resolve(msg);
+}
+function awaitResult2(requestId, send, timeoutMs) {
+  if (!send()) return Promise.reject(new Error("runner_offline"));
+  return new Promise((resolve4, reject) => {
+    const timer = setTimeout(() => {
+      pending4.delete(requestId);
+      reject(new Error("runner_timeout"));
+    }, timeoutMs);
+    pending4.set(requestId, { resolve: resolve4, reject, timer });
+  });
+}
+function requestGhRunnersProvision(runnerId, projectId, sealedBundle, timeoutMs) {
+  const requestId = nanoid36(16);
+  return awaitResult2(
+    requestId,
+    () => sendToRunner(runnerId, { type: "provision_gh_runners", requestId, projectId, sealedBundle }),
+    timeoutMs
+  );
+}
+function requestGhRunnersDelete(runnerId, projectId, sealedBundle, timeoutMs) {
+  const requestId = nanoid36(16);
+  return awaitResult2(
+    requestId,
+    () => sendToRunner(runnerId, {
+      type: "delete_gh_runners",
+      requestId,
+      projectId,
+      ...sealedBundle ? { sealedBundle } : {}
+    }),
+    timeoutMs
+  );
+}
+
+// src/application/write-model.ts
+init_farm2();
+init_runner2();
+init_init_status();
+init_sandbox_reg_tokens();
+init_abuse_throttle();
 
 // src/projects/forget.ts
 init_legacy_cred_bundles();
@@ -33987,8 +34273,71 @@ async function sweepOrphanedProjectRows(db) {
   return removed;
 }
 
+// src/runner/bindings.ts
+function parseGhRunnerBindings(json) {
+  if (!json) return [];
+  try {
+    const parsed = JSON.parse(json);
+    return Array.isArray(parsed.bindings) ? parsed.bindings : [];
+  } catch {
+    return [];
+  }
+}
+function serialize(bindings) {
+  return JSON.stringify({ bindings });
+}
+async function upsertGhRunnerBinding(db, projectId, binding) {
+  await db.tx(async (tx) => {
+    const row = await tx.get(
+      `SELECT gh_runner_bindings_json as bindingsJson FROM projects WHERE id = ?`,
+      projectId
+    );
+    if (!row) return;
+    const bindings = parseGhRunnerBindings(row.bindingsJson).filter(
+      (b) => !(b.owner === binding.owner && b.repo === binding.repo)
+    );
+    bindings.push(binding);
+    await tx.run(
+      `UPDATE projects SET gh_runner_bindings_json = ? WHERE id = ?`,
+      serialize(bindings),
+      projectId
+    );
+  });
+}
+async function removeGhRunnerBinding(db, projectId, owner, repo) {
+  return db.tx(async (tx) => {
+    const row = await tx.get(
+      `SELECT gh_runner_bindings_json as bindingsJson FROM projects WHERE id = ?`,
+      projectId
+    );
+    if (!row) return false;
+    const bindings = parseGhRunnerBindings(row.bindingsJson);
+    const kept = bindings.filter((b) => !(b.owner === owner && b.repo === repo));
+    if (kept.length === bindings.length) return false;
+    await tx.run(
+      `UPDATE projects SET gh_runner_bindings_json = ? WHERE id = ?`,
+      serialize(kept),
+      projectId
+    );
+    return true;
+  });
+}
+async function runnerBoundProjectCount(db, runnerId) {
+  const rows = await db.all(
+    `SELECT gh_runner_bindings_json AS json FROM projects WHERE gh_runner_bindings_json IS NOT NULL`
+  );
+  let n = 0;
+  for (const r of rows) {
+    try {
+      const bindings = JSON.parse(r.json).bindings ?? [];
+      if (bindings.some((b) => b.runnerId === runnerId)) n++;
+    } catch {
+    }
+  }
+  return n;
+}
+
 // src/application/write-model.ts
-init_bindings();
 init_tracking_commands();
 
 // src/config-proposals/apply.ts
@@ -34122,10 +34471,27 @@ function conflict(reason) {
 function stale() {
   return { ok: false, refusal: "stale_revision" };
 }
+function notFound() {
+  return { ok: false, refusal: "not_found" };
+}
+var FARM_PROVISION_TIMEOUT_MS = 6e4;
+var GH_RUNNER_RELAY_TIMEOUT_MS = 12e4;
+function nodeUnavailable(capability, err) {
+  const reason = err instanceof Error ? err.message : `${capability}_error`;
+  const what = capability === "farm" ? "The farm" : "The runner host";
+  return {
+    ok: false,
+    refusal: "capability_unavailable",
+    capability,
+    message: reason === `${capability}_timeout` ? `${what} did not answer in time. Try again once it is responsive.` : reason === `${capability}_offline` ? `${what} is offline. Start it and try again.` : `${what} could not be reached for this. Try again in a moment.`,
+    retryable: true
+  };
+}
 function taskState(row) {
   return { ...row, revision: String(row.updatedAt) };
 }
-function createWriteModel(db, log) {
+var WORKER_REG_TOKEN_MINTS = createAbuseThrottle({ windowMs: 60 * 6e4, max: 30 });
+function createWriteModel(db, log, hooks = {}) {
   async function readTaskRow(projectId, key) {
     const row = await db.get(
       `SELECT project_id as projectId, tracker_issue_key as key, phase,
@@ -34200,6 +34566,13 @@ function createWriteModel(db, log) {
     if (sandboxId !== null) sendToSandbox(sandboxId, { type: "pause_job", jobId: stored.sourceJobId });
     await cancelActiveJobs(db, `config::${stored.id}`);
   }
+  function isOperator(actor) {
+    return actor.email !== null && (hooks.isOperator?.(actor.email) ?? false);
+  }
+  async function ghRunnerHost(runnerId, actor) {
+    const owns = isOperator(actor) ? await db.get(`SELECT id FROM runners WHERE id = ?`, runnerId) !== void 0 : await viewerOwnsRunner(db, { email: actor.email ?? "", userId: actor.subjectId }, runnerId);
+    return owns ? ok(true) : notFound();
+  }
   return {
     async readTask(projectId, taskKey) {
       const row = await readTaskRow(projectId, taskKey);
@@ -34671,6 +35044,153 @@ function createWriteModel(db, log) {
      * daemon behind it. The Context Repo remote is not touched: what the
      * pipeline wrote about the work outlives the record of the project.
      */
+    // --- registration and the account's fleet (DEV-927) ---
+    async createProject({ project, owner }) {
+      const trackerProvider = project.trackerProvider;
+      const inserted = await db.tx(async (tx) => {
+        const existing = await tx.get(`SELECT id FROM projects WHERE id = ?`, project.projectId);
+        if (existing) return conflict("project_already_exists");
+        const now = Date.now();
+        await tx.run(
+          `INSERT INTO projects (id, name, automation_level, youtrack_project_key, tracker_provider,
+                                 repos_json, owner_email, owner_user_id, language_json,
+                                 provisioning_status, context_repo_json, provisioned_at, provisioning_error, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'provisioned', ?, ?, NULL, ?)`,
+          project.projectId,
+          project.name,
+          project.automationLevel,
+          project.trackerProjectKey,
+          trackerProvider,
+          JSON.stringify(
+            project.repos.map((r) => ({
+              name: r.name,
+              host: r.host,
+              owner: r.owner,
+              repoName: r.repoName,
+              ...r.defaultBranch ? { defaultBranch: r.defaultBranch } : {},
+              ...r.mountAs ? { mountAs: r.mountAs } : {},
+              ...r.mirror ? { mirror: { host: r.mirror.host, owner: r.mirror.owner, repoName: r.mirror.repoName } } : {}
+            }))
+          ),
+          owner.email,
+          owner.subjectId,
+          project.language === null ? null : JSON.stringify(project.language),
+          JSON.stringify(project.contextRepo),
+          now,
+          now
+        );
+        return ok({ projectId: project.projectId });
+      });
+      if (!inserted.ok) return inserted;
+      await beginInitTracking(db, project.projectId, "registered");
+      log.info({ projectId: project.projectId, contextRepo: project.contextRepo }, "project registered, Context Repo provisioned by the client");
+      hooks.projectRegistered?.({
+        projectId: project.projectId,
+        name: project.name,
+        automationLevel: project.automationLevel,
+        ownerEmail: owner.email,
+        repoCount: project.repos.length
+      });
+      return inserted;
+    },
+    async provisionOnFarm({ farmId, projectId, sealedBundle, actor }) {
+      const usable = isOperator(actor) ? await db.get(`SELECT id FROM farms WHERE id = ?`, farmId) !== void 0 : await viewerOwnsFarm(db, { email: actor.email ?? "", userId: actor.subjectId }, farmId);
+      if (!usable) return notFound();
+      await beginInitTracking(db, projectId, "farm_provisioning");
+      let result;
+      try {
+        result = await requestProvision(farmId, projectId, sealedBundle, FARM_PROVISION_TIMEOUT_MS);
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : "provision_failed";
+        await recordInitError(
+          db,
+          projectId,
+          reason === "farm_offline" ? "the hosting farm is offline" : reason === "farm_timeout" ? "the hosting farm did not respond in time" : `farm provisioning failed: ${reason}`
+        );
+        return nodeUnavailable("farm", err);
+      }
+      if (result.ok) {
+        await db.run(`UPDATE projects SET farm_id = ? WHERE id = ?`, farmId, projectId);
+        await advanceInitPhase(db, projectId, "daemon_starting");
+        requestFarmPoolSync(db, farmId).catch(
+          (err) => log.warn({ farmId, err }, "farm pool sync after provision failed")
+        );
+      } else {
+        await recordInitError(db, projectId, `farm provisioning failed: ${result.error ?? "unknown error"}`);
+      }
+      return ok({ ok: result.ok, daemonStatus: result.daemonStatus ?? null, error: result.error ?? null });
+    },
+    async provisionGhRunners({ runnerId, projectId, sealedBundle, actor }) {
+      const guard = await ghRunnerHost(runnerId, actor);
+      if (!guard.ok) return guard;
+      let result;
+      try {
+        result = await requestGhRunnersProvision(runnerId, projectId, sealedBundle, GH_RUNNER_RELAY_TIMEOUT_MS);
+      } catch (err) {
+        return nodeUnavailable("runner", err);
+      }
+      const runners = result.runners ?? [];
+      if (result.ok) {
+        const connectedAt = Date.now();
+        for (const r of runners) {
+          await upsertGhRunnerBinding(db, projectId, {
+            owner: r.owner,
+            repo: r.repo,
+            runnerId,
+            connectedAt,
+            status: r.status,
+            ...r.error ? { error: r.error } : {},
+            ...r.labels ? { labels: r.labels } : {}
+          });
+        }
+      }
+      return ok({
+        ok: result.ok,
+        runners: runners.map((r) => ({ owner: r.owner, repo: r.repo, status: r.status, error: r.error ?? null, labels: r.labels ?? [] })),
+        error: result.error ?? null
+      });
+    },
+    async teardownGhRunners({ runnerId, projectId, sealedBundle, repo, actor }) {
+      const guard = await ghRunnerHost(runnerId, actor);
+      if (!guard.ok) return guard;
+      let result;
+      try {
+        result = await requestGhRunnersDelete(runnerId, projectId, sealedBundle ?? void 0, GH_RUNNER_RELAY_TIMEOUT_MS);
+      } catch (err) {
+        return nodeUnavailable("runner", err);
+      }
+      if (result.ok && repo !== null) {
+        await removeGhRunnerBinding(db, projectId, repo.owner, repo.repo);
+      }
+      return ok({ ok: result.ok, error: result.error ?? null });
+    },
+    async enqueueProjectIndex({ projectId, kind }) {
+      const p = await db.get(`SELECT id, context_repo_json as contextRepoJson FROM projects WHERE id = ?`, projectId);
+      if (!p) return notFound();
+      if (!p.contextRepoJson) return conflict("context_repo_not_provisioned");
+      const jobId = kind === "backfill" ? await enqueueBackfillJob(db, projectId) : await enqueueIndexJob(db, projectId);
+      await advanceInitPhase(db, projectId, "indexing");
+      log.info({ projectId, jobId, kind }, kind === "backfill" ? "backfill job enqueued" : "index job enqueued");
+      return ok({ jobId });
+    },
+    async issueWorkerRegistrationToken({ owner }) {
+      if (owner.email === null) return { ok: false, refusal: "unprocessable", reason: "account_has_no_email" };
+      if (!WORKER_REG_TOKEN_MINTS.take(`email:${owner.email}`)) {
+        log.warn({ email: owner.email }, "ephemeral sandbox reg token mint throttled");
+        return { ok: false, refusal: "rate_limited" };
+      }
+      const issued = await issueEphemeralSandboxRegToken(db, owner.email);
+      log.info({ email: owner.email }, "ephemeral sandbox reg token issued for a client");
+      return ok(issued);
+    },
+    async reportInitStatus({ projectId, phase, error }) {
+      const recorded = await advanceInitPhase(db, projectId, phase);
+      if (error !== null) {
+        const cur = await getInitStatus(db, projectId);
+        if (cur && cur.phase === phase) await recordInitError(db, projectId, error);
+      }
+      return ok({ recorded });
+    },
     async deleteProject({ projectId }) {
       const row = await db.get(`SELECT farm_id as farmId FROM projects WHERE id = ?`, projectId);
       if (!row) return conflict("project_not_found");
@@ -36884,8 +37404,6 @@ init_settings();
 init_users();
 init_ws();
 init_sandbox2();
-init_provision();
-init_bindings();
 async function adminConsoleRoutes(app, deps) {
   const { db, config, mailer, logFile } = deps;
   app.get("/api/admin/users", async (req, reply) => {
@@ -39079,10 +39597,18 @@ async function negotiateJobCredentials(db, spec, workerId, log, issuer) {
 // src/routes/jobs.ts
 init_sandbox2();
 init_ws();
+init_route_registry();
 async function jobsRoutes(app, deps) {
   const { db, config } = deps;
   const notifyDeps = deps.notify;
-  app.post("/jobs/claim", async (req, reply) => {
+  app.post("/node/v1/jobs/claim", routeMeta({
+    surface: "node",
+    operationId: "node.jobs.claim",
+    authPolicy: "node_actor",
+    resourcePolicy: "node.connect",
+    stability: "preview",
+    summary: "Claim the next job for this SANDBOX (long poll)"
+  }), async (req, reply) => {
     const sandbox = await authenticateSandboxByBearer(db, req.headers.authorization);
     if (!sandbox) {
       return reply.status(401).send({ error: "unauthorized" });
@@ -39136,8 +39662,16 @@ async function jobsRoutes(app, deps) {
     }
   });
   app.post(
-    "/jobs/heartbeat",
+    "/node/v1/jobs/heartbeat",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.jobs.heartbeat",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Keep a claimed job's lease alive"
+      }),
       schema: {
         body: {
           type: "object",
@@ -39199,8 +39733,16 @@ async function jobsRoutes(app, deps) {
     }
   );
   app.post(
-    "/jobs/release",
+    "/node/v1/jobs/release",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.jobs.release",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Hand a claimed job back to the queue"
+      }),
       schema: {
         body: {
           type: "object",
@@ -39236,8 +39778,16 @@ async function jobsRoutes(app, deps) {
     }
   );
   app.post(
-    "/jobs/result",
+    "/node/v1/jobs/result",
     {
+      ...routeMeta({
+        surface: "node",
+        operationId: "node.jobs.result",
+        authPolicy: "node_actor",
+        resourcePolicy: "node.connect",
+        stability: "preview",
+        summary: "Report a finished job"
+      }),
       schema: {
         body: {
           type: "object",
@@ -39299,9 +39849,7 @@ init_dist();
 init_auth();
 init_project_access();
 init_users();
-init_cli_auth();
 init_lifecycle();
-init_queue();
 init_context_outbox();
 init_init_status();
 init_project_config();
@@ -39510,7 +40058,6 @@ function requestTrackerFields(projectId, projectKey, timeoutMs) {
 
 // src/routes/projects.ts
 init_ws();
-init_provision();
 
 // src/farm/move.ts
 init_ws();
@@ -39594,227 +40141,10 @@ function requestGhRunnerTeardown(projectId, runner, target, timeoutMs) {
 }
 
 // src/routes/projects.ts
-init_bindings();
 init_farm2();
 init_runner2();
-var createProjectBodySchema = {
-  type: "object",
-  required: ["projectId", "name", "automationLevel", "repos"],
-  properties: {
-    projectId: { type: "string" },
-    name: { type: "string", minLength: 1, maxLength: 200 },
-    automationLevel: { type: "string", enum: ["assisted", "full"] },
-    // ADR-0034 (DEV-456): tracker provider chosen at init; absent (older CLI)
-    // = youtrack. For `internal` youtrackProjectKey carries the key prefix.
-    trackerProvider: { type: "string", enum: ["internal", "youtrack"] },
-    youtrackProjectKey: { type: "string" },
-    // DEV-200: legacy owner-email field. Still accepted so an older CLI's
-    // request validates, but ignored — ownership always comes from the CLI
-    // token's identity (DEV-377).
-    ownerEmail: { type: "string" },
-    repos: {
-      type: "array",
-      minItems: 0,
-      items: {
-        type: "object",
-        required: ["name", "host", "owner", "repoName"],
-        properties: {
-          name: { type: "string", minLength: 1 },
-          host: { type: "string", enum: ["github", "bitbucket", "gitlab"] },
-          owner: { type: "string", minLength: 1 },
-          repoName: { type: "string", minLength: 1 },
-          defaultBranch: { type: "string" },
-          mountAs: { type: "string" }
-        }
-      }
-    },
-    // DEV-65 (ADR-0008): the CLI provisions the Context Repo and reports the
-    // resolved location here. The HUB only records it — it never holds git
-    // credentials. Absent only on the legacy HUB-provisioning path.
-    contextRepo: {
-      type: "object",
-      required: ["host", "owner", "name", "cloneUrl", "branch"],
-      properties: {
-        // DEV-875: `local` = a bare repository on the CLI's machine, reported
-        // with its filesystem path as `cloneUrl`. The HUB records it like any
-        // other location — it has no git access to either kind.
-        host: { type: "string", enum: ["github", "bitbucket", "gitlab", "local"] },
-        owner: { type: "string", minLength: 1 },
-        name: { type: "string", minLength: 1 },
-        cloneUrl: { type: "string", minLength: 1 },
-        branch: { type: "string", minLength: 1 }
-      }
-    }
-  }
-};
-var repoSpecSchema = {
-  type: "object",
-  required: ["name", "host", "owner", "repoName"],
-  additionalProperties: false,
-  properties: {
-    name: { type: "string", minLength: 1, maxLength: 100 },
-    host: { type: "string", enum: ["github", "bitbucket", "gitlab"] },
-    owner: { type: "string", minLength: 1 },
-    repoName: { type: "string", minLength: 1 },
-    defaultBranch: { type: "string" },
-    mountAs: { type: "string" }
-  }
-};
-async function resolveRepoMutator(db, config, req, reply, projectId) {
-  const cliAuth = await resolveCliAuth(db, config, req.headers.authorization);
-  if (cliAuth) {
-    if (!await canActOnProject(db, config, cliAuth, projectId)) {
-      reply.status(403).send({ error: "forbidden" });
-      return null;
-    }
-    return { email: cliAuth.email, userId: cliAuth.userId, viaCli: true };
-  }
-  const session = await requireProjectAccess(db, config, req, reply, projectId);
-  if (!session) return null;
-  return { email: session.email, userId: session.userId, viaCli: false };
-}
-async function loadRow(db, projectId) {
-  const row = await db.get(
-    `SELECT id, repos_json as reposJson, context_repo_json as contextRepoJson,
-            provisioning_status as provisioningStatus
-       FROM projects WHERE id = ?`,
-    projectId
-  );
-  return {
-    projectId: row.id,
-    provisioningStatus: row.provisioningStatus,
-    ...row.contextRepoJson ? { contextRepo: JSON.parse(row.contextRepoJson) } : {},
-    repos: JSON.parse(row.reposJson)
-  };
-}
 async function projectsRoutes(app, deps) {
-  const { db, config, mailer } = deps;
-  app.post(
-    "/projects",
-    { schema: { body: createProjectBodySchema } },
-    async (req, reply) => {
-      const auth = await resolveCliAuth(db, config, req.headers.authorization);
-      if (!auth) {
-        return reply.status(401).send({ error: "unauthorized" });
-      }
-      const body = req.body;
-      if (!PROJECT_ID_RE.test(body.projectId)) {
-        return reply.status(400).send({
-          error: "invalid_project_id",
-          hint: "lowercase letters, digits and dashes; starts with a letter; 2\u201331 chars"
-        });
-      }
-      const existing = await db.get(`SELECT id FROM projects WHERE id = ?`, body.projectId);
-      if (existing) {
-        return reply.status(409).send({ error: "project_already_exists", projectId: body.projectId });
-      }
-      const now = Date.now();
-      const ownerEmail = auth.email;
-      const ownerUserId = auth.userId;
-      const trackerProvider = body.trackerProvider === "internal" ? "internal" : "youtrack";
-      await db.run(`INSERT INTO projects (id, name, automation_level, youtrack_project_key,
-                               tracker_provider, repos_json, owner_email, owner_user_id,
-                               provisioning_status, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?)`, body.projectId, body.name, body.automationLevel, body.youtrackProjectKey ?? null, trackerProvider, JSON.stringify(body.repos), ownerEmail, ownerUserId, now);
-      if (!body.contextRepo) {
-        await db.run(`DELETE FROM projects WHERE id = ?`, body.projectId);
-        return reply.status(400).send({
-          error: "context_repo_required",
-          hint: "the CLI provisions the Context Repo and must send `contextRepo` (upgrade the CLI)"
-        });
-      }
-      app.log.info(
-        { projectId: body.projectId, contextRepo: body.contextRepo },
-        "project registered, Context Repo provisioned by CLI"
-      );
-      await db.run(`UPDATE projects
-         SET provisioning_status = 'provisioned', context_repo_json = ?,
-             provisioned_at = ?, provisioning_error = NULL
-         WHERE id = ?`, JSON.stringify(body.contextRepo), Date.now(), body.projectId);
-      await beginInitTracking(db, body.projectId, "registered");
-      void mailer.sendProjectRegistered(config.registrationNotifyEmail, {
-        projectName: body.name,
-        projectId: body.projectId,
-        automationLevel: body.automationLevel,
-        ownerEmail: ownerEmail ?? void 0,
-        repoCount: body.repos.length,
-        projectUrl: `${config.baseUrl}/?project=${encodeURIComponent(body.projectId)}`
-      }).catch(
-        (err) => app.log.error(
-          { err, projectId: body.projectId },
-          "failed to send project-registered notification"
-        )
-      );
-      return reply.status(201).send(await loadRow(db, body.projectId));
-    }
-  );
-  app.post(
-    "/projects/:projectId/index",
-    {
-      schema: {
-        body: {
-          type: "object",
-          properties: { reindex: { type: "boolean" }, backfill: { type: "boolean" } }
-        }
-      }
-    },
-    async (req, reply) => {
-      const auth = await resolveCliAuth(db, config, req.headers.authorization);
-      if (!auth) {
-        return reply.status(401).send({ error: "unauthorized" });
-      }
-      if (!await canActOnProject(db, config, auth, req.params.projectId)) {
-        return reply.status(403).send({ error: "forbidden" });
-      }
-      const p = await db.get(`SELECT id, context_repo_json as contextRepoJson FROM projects WHERE id = ?`, req.params.projectId);
-      if (!p) return reply.status(404).send({ error: "project_not_found" });
-      if (!p.contextRepoJson) {
-        return reply.status(409).send({ error: "context_repo_not_provisioned" });
-      }
-      const backfill = req.body?.backfill === true;
-      const jobId = backfill ? await enqueueBackfillJob(db, req.params.projectId) : await enqueueIndexJob(db, req.params.projectId);
-      await advanceInitPhase(db, req.params.projectId, "indexing");
-      app.log.info(
-        { projectId: req.params.projectId, jobId, reindex: req.body?.reindex === true, backfill },
-        backfill ? "backfill job enqueued" : "index job enqueued"
-      );
-      return reply.status(202).send({ jobId });
-    }
-  );
-  app.post(
-    "/projects/:projectId/init-status",
-    {
-      schema: {
-        body: {
-          type: "object",
-          required: ["phase"],
-          properties: {
-            phase: { type: "string", enum: ["context_cloning"] },
-            error: { type: "string", minLength: 1, maxLength: 500 }
-          }
-        }
-      }
-    },
-    async (req, reply) => {
-      const auth = await resolveCliAuth(db, config, req.headers.authorization);
-      if (!auth) {
-        return reply.status(401).send({ error: "unauthorized" });
-      }
-      if (!await canActOnProject(db, config, auth, req.params.projectId)) {
-        return reply.status(403).send({ error: "forbidden" });
-      }
-      const exists = await db.get(`SELECT id FROM projects WHERE id = ?`, req.params.projectId);
-      if (!exists) return reply.status(404).send({ error: "project_not_found" });
-      const advanced = await advanceInitPhase(db, req.params.projectId, req.body.phase);
-      if (req.body.error) {
-        const cur = await getInitStatus(db, req.params.projectId);
-        if (cur && cur.phase === req.body.phase) {
-          await recordInitError(db, req.params.projectId, req.body.error);
-        }
-      }
-      return { recorded: advanced };
-    }
-  );
+  const { db, config } = deps;
   app.get(
     "/projects/:projectId/pause",
     async (req, reply) => {
@@ -40201,50 +40531,6 @@ async function projectsRoutes(app, deps) {
       return { id, delivered };
     }
   );
-  app.get(
-    "/projects/:projectId/deliverables",
-    async (req, reply) => {
-      const projectId = req.params.projectId;
-      const cliAuth = await resolveCliAuth(db, config, req.headers.authorization);
-      if (cliAuth) {
-        if (!await canActOnProject(db, config, cliAuth, projectId)) {
-          return reply.status(403).send({ error: "forbidden" });
-        }
-        const exists = await db.get(`SELECT 1 FROM projects WHERE id = ?`, projectId);
-        if (!exists) return reply.status(404).send({ error: "project not found" });
-      } else if (!await requireProjectAccess(db, config, req, reply, projectId)) {
-        return reply;
-      }
-      const rows = await db.all(
-        `SELECT id, tracker_issue_key AS taskKey, title, phase, updated_at AS updatedAt
-           FROM tasks
-          WHERE project_id = ? AND (archived IS NULL OR archived = 0)
-            AND phase IN ('TRACKING', 'AWAITING_CLUSTER', 'DONE', 'NEEDS_MANUAL')
-          ORDER BY CASE WHEN phase IN ('TRACKING', 'AWAITING_CLUSTER') THEN 0 ELSE 1 END,
-                   updated_at DESC
-          LIMIT 50`,
-        projectId
-      );
-      const deliverables = [];
-      for (const r of rows) {
-        const byRepo = await loadTaskBranchesByRepo(db, r.id);
-        const repos = Object.entries(byRepo).map(([repoName, b]) => ({
-          repoName,
-          branchName: b.branchName,
-          baseRef: b.baseRef
-        }));
-        if (repos.length === 0) continue;
-        deliverables.push({
-          taskKey: r.taskKey,
-          title: r.title,
-          phase: r.phase,
-          updatedAt: r.updatedAt,
-          repos
-        });
-      }
-      return { deliverables };
-    }
-  );
   app.get(
     "/projects/:projectId/prompts",
     async (req, reply) => {
@@ -40662,88 +40948,6 @@ async function projectsRoutes(app, deps) {
       return reply.status(202).send({ queued: true });
     }
   );
-  app.post(
-    "/projects/:projectId/repos",
-    { schema: { body: repoSpecSchema } },
-    async (req, reply) => {
-      const actor = await resolveRepoMutator(db, config, req, reply, req.params.projectId);
-      if (!actor) return reply;
-      const { projectId } = req.params;
-      const repo = req.body;
-      const mountAs = repo.mountAs ?? repo.name;
-      const outcome = await db.tx(async (tx) => {
-        const row = await tx.get(`SELECT repos_json as reposJson FROM projects WHERE id = ?`, projectId);
-        if (!row) return { status: 404, error: "project_not_found" };
-        const repos = JSON.parse(row.reposJson);
-        if (!actor.viaCli && repos.length > 0 && !repos.some((r) => r.host === repo.host)) {
-          return {
-            status: 409,
-            error: "unknown_host",
-            hint: "add a repo on a new git host from the CLI (`codepipe repo add`), where its token is entered locally"
-          };
-        }
-        if (repos.some((r) => r.name === repo.name)) return { status: 409, error: "duplicate_repo_name" };
-        if (repos.some((r) => (r.mountAs ?? r.name) === mountAs)) {
-          return { status: 409, error: "duplicate_mount_as" };
-        }
-        const added = {
-          name: repo.name,
-          host: repo.host,
-          owner: repo.owner,
-          repoName: repo.repoName,
-          ...repo.defaultBranch ? { defaultBranch: repo.defaultBranch } : {},
-          mountAs
-        };
-        await tx.run(`UPDATE projects SET repos_json = ? WHERE id = ?`, JSON.stringify([...repos, added]), projectId);
-        return { ok: true, added };
-      });
-      if (!("ok" in outcome)) {
-        return reply.status(outcome.status).send({ error: outcome.error, ...outcome.hint ? { hint: outcome.hint } : {} });
-      }
-      if (!actor.viaCli) {
-        const msg = { type: "provision_repo", projectId, repo: outcome.added };
-        const delivered = sendToProjectCli(projectId, msg);
-        app.log.info({ projectId, repo: repo.name, by: actor.email, delivered }, "repo added, provision_repo dispatched");
-      } else {
-        app.log.info({ projectId, repo: repo.name, by: actor.email }, "repo added by CLI");
-      }
-      return reply.status(201).send(await loadRow(db, projectId));
-    }
-  );
-  app.delete(
-    "/projects/:projectId/repos/:name",
-    async (req, reply) => {
-      const actor = await resolveRepoMutator(db, config, req, reply, req.params.projectId);
-      if (!actor) return reply;
-      const { projectId, name } = req.params;
-      const purge = req.query.purge === "true" || req.query.purge === "1";
-      const outcome = await db.tx(async (tx) => {
-        const row = await tx.get(`SELECT repos_json as reposJson FROM projects WHERE id = ?`, projectId);
-        if (!row) return { status: 404, error: "project_not_found" };
-        const repos = JSON.parse(row.reposJson);
-        const removed = repos.find((r) => r.name === name);
-        if (!removed) return { status: 404, error: "repo_not_found" };
-        await tx.run(
-          `UPDATE projects SET repos_json = ? WHERE id = ?`,
-          JSON.stringify(repos.filter((r) => r.name !== name)),
-          projectId
-        );
-        return { ok: true, removed };
-      });
-      if (!("ok" in outcome)) return reply.status(outcome.status).send({ error: outcome.error });
-      if (outcome.removed.host === "github") {
-        await removeGhRunnerBinding(db, projectId, outcome.removed.owner, outcome.removed.repoName);
-      }
-      if (!actor.viaCli) {
-        const msg = { type: "remove_repo", projectId, repoName: name, ...purge ? { purge: true } : {} };
-        const delivered = sendToProjectCli(projectId, msg);
-        app.log.info({ projectId, repo: name, by: actor.email, purge, delivered }, "repo removed, remove_repo dispatched");
-      } else {
-        app.log.info({ projectId, repo: name, by: actor.email }, "repo removed by CLI");
-      }
-      return reply.status(200).send(await loadRow(db, projectId));
-    }
-  );
   app.get(
     "/projects/:projectId/tracker-status",
     async (req, reply) => {
@@ -41268,8 +41472,6 @@ async function bugReportRoutes(app, deps) {
 
 // src/server.ts
 init_ws();
-init_provision();
-init_provision2();
 init_context_read();
 var __dirname = dirname4(fileURLToPath3(import.meta.url));
 var DASHBOARD_DIST = resolve3(__dirname, "../../dashboard/dist");
@@ -41532,13 +41734,28 @@ async function buildServer(config, db) {
       await apiV1ReadRoutes(instance, {
         db,
         config,
-        read: createReadOperations(createReadModel(db), authorizer)
+        read: createReadOperations(createReadModel(db, { isOperator: (email) => isSuperUser(config, email) }), authorizer)
       });
       await apiV1MutationRoutes(instance, {
         db,
         config,
         commands: createCommandOperations({
-          write: createWriteModel(db, app.log),
+          write: createWriteModel(db, app.log, {
+            isOperator: (email) => isSuperUser(config, email),
+            // DEV-216: tell the operator a project was registered. Fire-and-
+            // forget — a mail failure must not fail the registration the
+            // client is waiting on.
+            projectRegistered: (n) => {
+              void mailer.sendProjectRegistered(config.registrationNotifyEmail, {
+                projectName: n.name,
+                projectId: n.projectId,
+                automationLevel: n.automationLevel,
+                ownerEmail: n.ownerEmail ?? void 0,
+                repoCount: n.repoCount,
+                projectUrl: `${config.baseUrl}/?project=${encodeURIComponent(n.projectId)}`
+              }).catch((err) => app.log.error({ err, projectId: n.projectId }, "failed to send project-registered notification"));
+            }
+          }),
           idempotency: createIdempotencyPort(db),
           authorizer,
           audit: createCommandAudit(db)